The TLS stack in Mono before 3.12.1 allows man-in-the-middle attackers to conduct message skipping attacks and consequently impersonate clients by leveraging missing handshake state validation, aka a "SMACK SKIP-TLS" issue.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade mono | Jul 30, 2024 | Jan 8, 2018 |
| Suse | — | Upgrade mono-develUpgrade mono-locale-extrasUpgrade mono-nunitUpgrade mono-data-firebirdUpgrade mono-dataUpgrade mono-wcfUpgrade bytefx-data-mysqlUpgrade mono-data-sqliteUpgrade mono-winformsUpgrade mono-webUpgrade monodoc-coreUpgrade mono-data-oracleUpgrade mono-coreUpgrade mono-extrasUpgrade mono-winfxcoreUpgrade mono-data-postgresqlUpgrade mono-data-sybaseUpgrade ibm-data-db2Upgrade mono-jscript | Dec 18, 2015 | Mar 24, 2015 |
| Ubuntu | — | Upgrade libmono-2.0-1Upgrade mono-runtime | Nov 8, 2024 | Jan 8, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub