The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_ssl_cert_certificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade serf | Jul 30, 2024 | Aug 19, 2014 |
| Freebsd | — | Upgrade serf | Dec 10, 2025 | Aug 11, 2014 |
| Gentoo Linux | — | Upgrade dev-vcs/subversion.Upgrade net-libs/serf. | Oct 30, 2017 | Aug 19, 2014 |
| Oracle Solaris | — | Upgrade entire to version 0.5.11-0.175.3.0.0.30.0 on Solaris 11.3 | May 29, 2017 | Aug 19, 2014 |
| Suse | — | Upgrade libserf-1-1Upgrade libserf-devel | Dec 18, 2015 | Aug 19, 2014 |
| Ubuntu | — | Upgrade libserf-1-1Upgrade libserf1 | Nov 8, 2024 | Aug 19, 2014 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub