| Package | Affected versions | Patched versions |
|---|---|---|
| ffmpeg | ≥ 9.0, < 9.0.2< 8.1.3 | 9.0.28.1.3 |
FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tls_open() of libavformat/tls_mbedtls.c, which skips hostname checks for IP-address hosts. Network attackers can intercept https, rtmps, or tls connections to IP-literal URLs with any trusted CA-issued certificate to read and tamper with streams.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free