Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2021-35497

TIBCO FTL unvalidated SAN in client certificates

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
tibco

Description

The FTL Server (tibftlserver) and Docker images containing tibftlserver components of TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition, TIBCO ActiveSpaces - Developer Edition, TIBCO ActiveSpaces - Enterprise Edition, TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, TIBCO FTL - Enterprise Edition, TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contain a vulnerability that theoretically allows a non-administrative, authenticated FTL user to trick the affected components into creating illegitimate certificates. These maliciously generated certificates can be used to enable man-in-the-middle attacks or to escalate privileges so that the malicious user has administrative privileges. Affected releases are TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO ActiveSpaces - Developer Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO ActiveSpaces - Enterprise Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO FTL - Community Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO FTL - Developer Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO FTL - Enterprise Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO eFTL - Community Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO eFTL - Developer Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, and TIBCO eFTL - Enterprise Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

TIBCO Software Inc. TIBCO ActiveSpaces - Community Edition

  • 4.3.0affected
  • 4.4.0affected
  • 4.5.0affected
  • 4.6.0affected
  • 4.6.1affected
  • 4.6.2affected

TIBCO Software Inc. TIBCO ActiveSpaces - Developer Edition

  • 4.3.0affected
  • 4.4.0affected
  • 4.5.0affected
  • 4.6.0affected
  • 4.6.1affected
  • 4.6.2affected

TIBCO Software Inc. TIBCO ActiveSpaces - Enterprise Edition

  • 4.3.0affected
  • 4.4.0affected
  • 4.5.0affected
  • 4.6.0affected
  • 4.6.1affected
  • 4.6.2affected

TIBCO Software Inc. TIBCO FTL - Community Edition

  • 6.2.0affected
  • 6.3.0affected
  • 6.3.1affected
  • 6.4.0affected
  • 6.5.0affected
  • 6.6.0affected
  • 6.6.1affected
  • 6.7.0affected

TIBCO Software Inc. TIBCO FTL - Developer Edition

  • 6.2.0affected
  • 6.3.0affected
  • 6.3.1affected
  • 6.4.0affected
  • 6.5.0affected
  • 6.6.0affected
  • 6.6.1affected
  • 6.7.0affected

TIBCO Software Inc. TIBCO FTL - Enterprise Edition

  • 6.2.0affected
  • 6.3.0affected
  • 6.3.1affected
  • 6.4.0affected
  • 6.5.0affected
  • 6.6.0affected
  • 6.6.1affected
  • 6.7.0affected

TIBCO Software Inc. TIBCO eFTL - Community Edition

  • 6.2.0affected
  • 6.3.0affected
  • 6.3.1affected
  • 6.4.0affected
  • 6.5.0affected
  • 6.6.0affected
  • 6.6.1affected
  • 6.7.0affected

TIBCO Software Inc. TIBCO eFTL - Developer Edition

  • 6.2.0affected
  • 6.3.0affected
  • 6.3.1affected
  • 6.4.0affected
  • 6.5.0affected
  • 6.6.0affected
  • 6.6.1affected
  • 6.7.0affected

TIBCO Software Inc. TIBCO eFTL - Enterprise Edition

  • 6.2.0affected
  • 6.3.0affected
  • 6.3.1affected
  • 6.4.0affected
  • 6.5.0affected
  • 6.6.0affected
  • 6.6.1affected
  • 6.7.0affected

References