CVE-2012-6087
16.09.2013, 13:02
repository/s3/S3.php in the Amazon S3 library in Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to an incorrect CURLOPT_SSL_VERIFYHOST value.Enginsight
| Vendor | Product | Version |
|---|---|---|
| moodle | moodle | 𝑥 ≤ 2.2.11 |
| moodle | moodle | 2.2.0 |
| moodle | moodle | 2.2.1 |
| moodle | moodle | 2.2.2 |
| moodle | moodle | 2.2.3 |
| moodle | moodle | 2.2.4 |
| moodle | moodle | 2.2.5 |
| moodle | moodle | 2.2.6 |
| moodle | moodle | 2.2.7 |
| moodle | moodle | 2.2.8 |
| moodle | moodle | 2.2.9 |
| moodle | moodle | 2.2.10 |
| moodle | moodle | 2.3.0 |
| moodle | moodle | 2.3.1 |
| moodle | moodle | 2.3.2 |
| moodle | moodle | 2.3.3 |
| moodle | moodle | 2.3.4 |
| moodle | moodle | 2.3.5 |
| moodle | moodle | 2.3.6 |
| moodle | moodle | 2.3.7 |
| moodle | moodle | 2.3.8 |
| moodle | moodle | 2.4.0 |
| moodle | moodle | 2.4.1 |
| moodle | moodle | 2.4.2 |
| moodle | moodle | 2.4.3 |
| moodle | moodle | 2.4.4 |
| moodle | moodle | 2.4.5 |
| moodle | moodle | 2.5.0 |
| moodle | moodle | 2.5.1 |
𝑥
= Vulnerable software versions
Ubuntu Releases
Common Weakness Enumeration
References