{
  "schema_version": "1.7.0",
  "id": "MGASA-2014-0548",
  "published": "2014-12-26T17:04:58Z",
  "modified": "2014-12-26T16:56:09Z",
  "summary": "Updated smack packages fix security vulnerabilities",
  "details": "Updated smack packages fix security vulnerabilities:\n\nThe ServerTrustManager component in the Ignite Realtime Smack XMPP API\nbefore 4.0.0-rc1 does not verify basicConstraints and nameConstraints in\nX.509 certificate chains from SSL servers, which allows man-in-the-middle\nattackers to spoof servers and obtain sensitive information via a crafted\ncertificate chain (CVE-2014-0363).\n\nThe Ignite Realtime Smack XMPP API 4.x before 4.0.2, and 3.x and 2.x when a\ncustom SSLContext is used, does not verify that the server hostname matches\na domain name in the subject's Common Name (CN) or subjectAltName field of\nthe X.509 certificate, which allows man-in-the-middle attackers to spoof SSL\nservers via an arbitrary valid certificate (CVE-2014-5075).\n",
  "upstream": [
    "CVE-2014-0363",
    "CVE-2014-5075"
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://advisories.mageia.org/MGASA-2014-0548.html"
    },
    {
      "type": "REPORT",
      "url": "https://bugs.mageia.org/show_bug.cgi?id=14040"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/pipermail/package-announce/2014-September/137233.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/pipermail/package-announce/2014-December/146206.html"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Mageia:4",
        "name": "smack",
        "purl": "pkg:rpm/mageia/smack?arch=source&distro=mageia-4"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.2.2-4.1.mga4"
            }
          ]
        }
      ],
      "ecosystem_specific": {
        "section": "core"
      }
    }
  ],
  "credits": [
    {
      "name": "Mageia",
      "type": "COORDINATOR",
      "contact": [
        "https://wiki.mageia.org/en/Packages_Security_Team"
      ]
    }
  ]
}