Improper input validation in Irssi

CVE-2010-1155

Irssi before 0.8.15, when SSL is used, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) field or a Subject Alternative Name field of the X.509 certificate, which allows man-in-the-middle attackers to spoof IRC servers via an arbitrary certificate.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.016 (72.7th percentile) — read the EPSS interpretation.

Affected products

  • Irssi — versions 0.8.6, 0.8.10, 0.8.0
  • N/a — versions n/a

Weakness classification (CWE)

References