CVE-2019-5102
An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.1. When connecting to a remote server, the server's SSL certificate is checked but no action is taken when the certificate is invalid. An attacker could exploit this behavior by performing a man-in-the-middle attack, providing any certificate, leading to the theft of all the data sent by the client during the first request.An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.1. When connecting to a remote server, the server's SSL certificate is checked but no action is taken when the certificate is invalid. An attacker could exploit this behavior by performing a man-in-the-middle attack, providing any certificate, leading to the theft of all the data sent by the client during the first request.
- Affected products
- Openwrt
- Openwrt
- = 15.05.1, 18.06.4
- Fix
- Available
- CVSS 3.1
- 5.9 MEDIUM
- EPSS
- 0.8% (52th percentile)
- Weakness
- CWE-295
- NVD status
- Modified
- Published
- 2019-11-18
No indexed exploits for CVE-2019-5102 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2019-5102 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.