CVE-2017-1000415
UnknownEPSS 0.48%
Last modified
CVE-2017-1000415 is a vulnerability of currently unknown severity. MatrixSSL version 3.7.2 has an incorrect UTCTime date range validation in its X.509 certificate validation process resulting in some certificates have their expiration (beginning) year extended (delayed) by 100 years.. EPSS estimates a 0.48% chance of exploitation in the next 30 days.
Description
MatrixSSL version 3.7.2 has an incorrect UTCTime date range validation in its X.509 certificate validation process resulting in some certificates have their expiration (beginning) year extended (delayed) by 100 years.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Matrixssl | Matrixssl | 3.7.2 |
References
- https://www.ieee-security.org/TC/SP2017/papers/231.pdfThird Party Advisory
- https://www.youtube.com/watch?v=FW--c_F_cY8Third Party Advisory
- https://www.ieee-security.org/TC/SP2017/papers/231.pdfThird Party Advisory
- https://www.youtube.com/watch?v=FW--c_F_cY8Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-1000415?
MatrixSSL version 3.7.2 has an incorrect UTCTime date range validation in its X.509 certificate validation process resulting in some certificates have their expiration (beginning) year extended (delayed) by 100 years.
How severe is CVE-2017-1000415?
Severity scoring for CVE-2017-1000415 is pending analysis. The EPSS model estimates a 0.48% probability of exploitation in the next 30 days.
How do I fix CVE-2017-1000415?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-1000409A buffer overflow in glibc 2.5 (released on September 29, 20…
- CVE-2017-1000410The Linux kernel version 3.3-rc1 and later is affected by a …
- CVE-2017-1000411OpenFlow Plugin and OpenDayLight Controller versions Nitroge…
- CVE-2017-1000412Linaro's open source TEE solution called OP-TEE, version 2.4…
- CVE-2017-1000413Linaro's open source TEE solution called OP-TEE, version 2.4…
- CVE-2017-1000414ImpulseAdventure JPEGsnoop version 1.7.5 is vulnerable to a …
- CVE-2017-1000416axTLS version 1.5.3 has a coding error in the ASN.1 parser r…
- CVE-2017-1000417MatrixSSL version 3.7.2 adopts a collision-prone OID compari…
- CVE-2017-1000418The WildMidi_Open function in WildMIDI since commit d8a46682…
- CVE-2017-1000419phpBB version 3.2.0 is vulnerable to SSRF in the Remote Avat…
- CVE-2017-1000420Syncthing version 0.14.33 and older is vulnerable to symlink…
- CVE-2017-1000421Gifsicle gifview 1.89 and older is vulnerable to a use-after…
Are you affected by CVE-2017-1000415?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST