CVE-2010-1194
EPSS 1.2%
Description
The match_component function in smtp-tls.c in libESMTP 1.0.3.r1, and possibly other versions including 1.0.4, treats two strings as equal if one is a substring of the other, which allows remote attackers to spoof trusted certificates via a crafted subjectAltName.
How to fix CVE-2010-1194
To remediate CVE-2010-1194, upgrade the affected package to a fixed version below.
- Debian/libesmtp—upgrade to 1.0.4-2 or later
Is CVE-2010-1194 being exploited?
Low — EPSS is 1.2%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 1.0.4-2