| Package | Affected versions | Patched versions |
|---|---|---|
| californium | = 3.0.0≥ 2.0.0, < 2.6.5 | 2.6.5 |
In Eclipse Californium version 2.0.0 to 2.6.4 and 3.0.0-M1 to 3.0.0-M3, the certificate based (x509 and RPK) DTLS handshakes accidentally succeeds without verifying the server side's signature on the client side, if that signature is not included in the server's ServerKeyExchange.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free