CVE-2021-34433CWE-322

CVE-2021-34433: vulnerability in The Eclipse Foundation Eclipse Californium

Published · Updated

Follow this CVE+ Monitor Eclipse Californium

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 0.3%
In Eclipse Californium version 2.0.0 to 2.6.4 and 3.0.0-M1 to 3.0.0-M3, the certificate based (x509 and RPK) DTLS handshakes accidentally succeeds without verifying the server side's signature on the client side, if that signature is not included in the server's ServerKeyExchange.
Affected products
The Eclipse Foundation · Eclipse Californium
Related CVEs — The Eclipse Foundation Eclipse Californium

In the same product, most dangerous first.

CVE-2020-27222—CVE-2020-27222EPSS 0.9%CVE-2022-2576—CVE-2022-2576EPSS 0.6%