Vulnerability in Oracle Jre

CVE-2003-1229

X509TrustManager in (1) Java Secure Socket Extension (JSSE) in SDK and JRE 1.4.0 through 1.4.0_01, (2) JSSE before 1.0.3, (3) Java Plug-in SDK and JRE 1.3.0 through 1.4.1, and (4) Java Web Start 1.0 through 1.2 incorrectly calls the isClientTrusted method when determining server trust, which results in improper validation of digital certificate and allows remote attackers to (1) falsely authenticate peers for SSL or (2) incorrectly validate signed JAR files.

Vulnerability class: Improper Certificate Validation

EPSS: 0.046 (90.8th percentile) — read the EPSS interpretation.

Affected products

Weakness classification (CWE)

Public proof-of-concept exploits

References

  • cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK, Broken Link)
  • cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK, Broken Link)
  • cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK, Broken Link)
  • cve@mitre.org (x_refsource_CONFIRM, Broken Link, Vendor Advisory)
  • cve@mitre.org (x_refsource_HP, vendor-advisory, Broken Link)
  • cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_XF)
  • cve@mitre.org (Patch, x_refsource_SECUNIA, Broken Link, Vendor Advisory, third-party-advisory)
  • cve@mitre.org (Patch, VDB Entry, Third Party Advisory, vdb-entry, Broken Link, x_refsource_BID)
  • cve@mitre.org (Broken Link, x_refsource_OVAL, signature, vdb-entry)
  • cve@mitre.org (vendor-advisory, Patch, x_refsource_SUNALERT, Broken Link, Vendor Advisory)

Frequently asked questions

What is CVE-2003-1229?
CVE-2003-1229 is a vulnerability in Oracle Jre, classified under Improper Certificate Validation. Published 2003-12-31.
Is CVE-2003-1229 known to be exploited?
1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.