Vulnerability in Oracle Jre
CVE-2003-1229
X509TrustManager in (1) Java Secure Socket Extension (JSSE) in SDK and JRE 1.4.0 through 1.4.0_01, (2) JSSE before 1.0.3, (3) Java Plug-in SDK and JRE 1.3.0 through 1.4.1, and (4) Java Web Start 1.0 through 1.2 incorrectly calls the isClientTrusted method when determining server trust, which results in improper validation of digital certificate and allows remote attackers to (1) falsely authenticate peers for SSL or (2) incorrectly validate signed JAR files.
Vulnerability class: Improper Certificate Validation
EPSS: 0.046 (90.8th percentile) — read the EPSS interpretation.
Affected products
- Oracle Jre
- Sun Java_web_start
- Sun Jsse — versions 1.0.3
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK, Broken Link)
- cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK, Broken Link)
- cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK, Broken Link)
- cve@mitre.org (x_refsource_CONFIRM, Broken Link, Vendor Advisory)
- cve@mitre.org (x_refsource_HP, vendor-advisory, Broken Link)
- cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_XF)
- cve@mitre.org (Patch, x_refsource_SECUNIA, Broken Link, Vendor Advisory, third-party-advisory)
- cve@mitre.org (Patch, VDB Entry, Third Party Advisory, vdb-entry, Broken Link, x_refsource_BID)
- cve@mitre.org (Broken Link, x_refsource_OVAL, signature, vdb-entry)
- cve@mitre.org (vendor-advisory, Patch, x_refsource_SUNALERT, Broken Link, Vendor Advisory)
Frequently asked questions
- What is CVE-2003-1229?
- CVE-2003-1229 is a vulnerability in Oracle Jre, classified under Improper Certificate Validation. Published 2003-12-31.
- Is CVE-2003-1229 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.