CVE-2026-84197
2026-09-08
20h18 +00:00
20h18 +00:00
指定 CVE 通知
随时了解指定 CVE 的变更。
CVE 描述
In Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto-javascript-client-node from 2.0.0 to 3.9.0 and of its predecessor package @eclipse-ditto/ditto-javascript-client-node_1.0 from 1.0.0 to 2.1.0, the WebSocket transport hard-codes rejectUnauthorized: false when creating the underlying ws WebSocket. Certificate chain and hostname validation are therefore disabled for every wss:// connection, and no builder option, constructor argument or environment variable lets an application turn validation back on. An attacker in a position to intercept the connection can present an arbitrary certificate, complete the TLS handshake, read the credentials that the configured authentication provider sends in the Authorization header of the WebSocket upgrade request, and read, alter or inject Ditto Protocol messages for the lifetime of the connection. The Java client, the browser/DOM JavaScript client and the HTTP transport of the Node.js client are not affected.
CVE 信息
相关弱点
| 弱点名称 | 来源 | |
|---|---|---|
| Improper Certificate Validation The product does not validate, or incorrectly validates, a certificate. |
||
| Improper Validation of Certificate with Host Mismatch The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host. |
||
| Channel Accessible by Non-Endpoint The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint. |
