CVE-2021-34599 Improper Certificate Validation in CODESYS Git
CODESYS Git fails to validate HTTPS certificates, allowing attackers to perform man-in-the-middle attacks to intercept or modify data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-34599?
CVE-2021-34599 is a high-severity vulnerability in CODESYS Git, published on 1 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Affected versions of CODESYS Git in Versions prior to V1.1.0.0 lack certificate validation in HTTPS handshakes. CODESYS Git does not implement certificate validation by default, so it does not verify that the server provides a valid and trusted HTTPS certificate. Since the certificate of the server to which the connection is made is not properly verified, the server connection is vulnerable to a man-in-the-middle attack.
Weakness: CWE-295
Which versions are affected by CVE-2021-34599?
It affects 1 product.
Products include Codesys Git.
How do I fix CVE-2021-34599?
No fix has been published for CVE-2021-34599 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-34599 being exploited?
There is no known exploitation of CVE-2021-34599 in the wild and no public exploit code.
Sources
Also known as GHSA-hgcw-m9r8-99rp.