Unscored severity · published Dec 31, 2003
CVE-2003-1229
X509TrustManager in (1) Java Secure Socket Extension (JSSE) in SDK and JRE 1.4.0 through 1.4.0_01, (2) JSSE before 1.0.3, (3) Java Plug-in SDK and JRE 1.3.0 through 1.4.1, and (4)…
–
CVSS
4.6%
EPSS
No
On KEV
Description
X509TrustManager in (1) Java Secure Socket Extension (JSSE) in SDK and JRE 1.4.0 through 1.4.0_01, (2) JSSE before 1.0.3, (3) Java Plug-in SDK and JRE 1.3.0 through 1.4.1, and (4) Java Web Start 1.0 through 1.2 incorrectly calls the isClientTrusted method when determining server trust, which results in improper validation of digital certificate and allows remote attackers to (1) falsely authenticate peers for SSL or (2) incorrectly validate signed JAR files.
Exploitation
Is it being used?
Exploit prediction (EPSS)4.6% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JW
Java Web Start · Sun
1.0 through 1.2 · source: NVD
JR
Jre · Oracle
1.3.0 through 1.4.1 · source: NVD
JS
Jsse · Sun
1.0.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2003-1229
CVE.org
https://www.cve.org/CVERecord?id=CVE-2003-1229
Broken Link
http://archives.neohapsis.com/archives/bugtraq/2003-01/0334.html
Broken Link
http://java.sun.com/products/jsse/CHANGES.txt
Broken Link
http://secunia.com/advisories/7943
Broken Link
http://securitytracker.com/id?1006007
Broken Link
http://securitytracker.com/id?1007483
Broken Link
http://sunsolve.sun.com/search/document.do?assetkey=1-26-50081-1
More from Jre
9.8
CVE-2016-3427
Oracle Java SE and JRockit Unspecified Vulnerability
9.8
CVE-2015-2590
Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability
9.8
CVE-2013-2465
Oracle Java SE Unspecified Vulnerability
9.8
CVE-2013-0422
Oracle JRE Remote Code Execution Vulnerability
9.8
CVE-2012-5076
Oracle Java SE Sandbox Bypass Vulnerability