What is CVE-2003-1229?

CVE-2003-1229 is a vulnerability in Oracle Jre, classified under Improper Certificate Validation. Published 2003-12-31.

Is CVE-2003-1229 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Oracle Jre

CVE-2003-1229

X509TrustManager in (1) Java Secure Socket Extension (JSSE) in SDK and JRE 1.4.0 through 1.4.0_01, (2) JSSE before 1.0.3, (3) Java Plug-in SDK and JRE 1.3.0 through 1.4.1, and (4) Java Web Start 1.0 through 1.2 incorrectly calls the isClientTrusted method when determining server trust, which results in improper validation of digital certificate and allows remote attackers to (1) falsely authenticate peers for SSL or (2) incorrectly validate signed JAR files.

Vulnerability class: Improper Certificate Validation

Published 2003-12-31 · last modified 2026-06-16.

CVSS v2 metric

CVSS v2 base score 7.5 (High). Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.

EPSS exploit prediction

EPSS: 0.046 (91.4th percentile), scored 2026-09-29.

Low probability of exploitation in the next 30 days, but still tracked. 91st percentile — 91.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.046 · newest: 0.046 · change: 0.000

Affected products

Weakness classification (CWE)

CWE-295 — Improper Certificate Validation

Public proof-of-concept exploits

Live-Hack-CVE/CVE-2003-1229

References

www.securitytracker.com/id (VDB Entry, Third Party Advisory, vdb-entry, Broken Link)
securitytracker.com/id (VDB Entry, Third Party Advisory, vdb-entry, Broken Link)
securitytracker.com/id (VDB Entry, Third Party Advisory, vdb-entry, Broken Link)
java.sun.com/products/jsse/CHANGES.txt (Broken Link, Vendor Advisory)
www1.itrc.hp.com/service/cki/docDisplay.do (vendor-advisory, Broken Link)
exchange.xforce.ibmcloud.com/vulnerabilities/11182 (VDB Entry, Third Party Advisory, vdb-entry)
secunia.com/advisories/7943 (Patch, Broken Link, Vendor Advisory, third-party-advisory)
www.securityfocus.com/bid/6682 (Patch, VDB Entry, Third Party Advisory, vdb-entry, Broken Link)
oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:5883 (Broken Link, signature, vdb-entry)
sunsolve.sun.com/search/document.do (vendor-advisory, Patch, Broken Link, Vendor Advisory)

Frequently asked questions

What is CVE-2003-1229?: CVE-2003-1229 is a vulnerability in Oracle Jre, classified under Improper Certificate Validation. Published 2003-12-31.
Is CVE-2003-1229 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.