Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
istream.c in w3m 0.5.2 and possibly other versions, when ssl_verify_server is enabled, does not properly handle a '\0' character in a domain name in the (1) subject's Common Name or (2) Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
W3M NULL Character CA SSL 证书确认安全绕过漏洞
Vulnerability Description
w3m是一款开源的基于文本的Web浏览器。 w3m的istream存在漏洞，当开启ssl_verify_server时，无法正确处理X.509证书(1)主题的公用名或(2)主题备用名中某域名的'\0'字符，攻击者可以利用合法认证机构颁发的特制证书冒充任意SSL服务器。
CVSS Information
N/A
Vulnerability Type
N/A