cvelistv5 - CVE-2018-0518

CVE-2018-0518

Vulnerability from cvelistv5

Published

2018-02-23 15:00

Modified

2024-08-05 03:28

Severity ?

Summary

LINE for iOS version 7.1.3 to 7.1.5 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

References

▼	URL	Tags
	vultures@jpcert.or.jp	https://jvn.jp/en/jp/JVN75453852/index.html	Third Party Advisory, VDB Entry
	vultures@jpcert.or.jp	https://linecorp.com/en/security/article/136	Vendor Advisory

Impacted products

▼	Vendor	Product
	LINE Corporation	LINE for iOS

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T03:28:11.157Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://linecorp.com/en/security/article/136"
          },
          {
            "name": "JVN#75453852",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVN",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN75453852/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "LINE for iOS",
          "vendor": "LINE Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "version 7.1.3 to 7.1.5"
            }
          ]
        }
      ],
      "datePublic": "2018-02-23T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "LINE for iOS version 7.1.3 to 7.1.5 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Fails to verify SSL certificates",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-02-23T14:57:01",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://linecorp.com/en/security/article/136"
        },
        {
          "name": "JVN#75453852",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVN"
          ],
          "url": "https://jvn.jp/en/jp/JVN75453852/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2018-0518",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "LINE for iOS",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "version 7.1.3 to 7.1.5"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "LINE Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "LINE for iOS version 7.1.3 to 7.1.5 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Fails to verify SSL certificates"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://linecorp.com/en/security/article/136",
              "refsource": "MISC",
              "url": "https://linecorp.com/en/security/article/136"
            },
            {
              "name": "JVN#75453852",
              "refsource": "JVN",
              "url": "https://jvn.jp/en/jp/JVN75453852/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2018-0518",
    "datePublished": "2018-02-23T15:00:00",
    "dateReserved": "2017-11-27T00:00:00",
    "dateUpdated": "2024-08-05T03:28:11.157Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2018-0518\",\"sourceIdentifier\":\"vultures@jpcert.or.jp\",\"published\":\"2018-02-23T15:29:00.213\",\"lastModified\":\"2018-03-20T19:16:05.380\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"LINE for iOS version 7.1.3 to 7.1.5 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.\"},{\"lang\":\"es\",\"value\":\"LINE para iOS, en versiones 7.1.3 a 7.1.5, no verifica los certificados X.509 de los servidores SSL, lo que permite que los atacantes Man-in-the-Middle (MitM) suplanten servidores y obtengan informaci\u00f3n sensible mediante un certificado manipulado.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":5.9,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":2.2,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:N/A:N\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":4.3},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-295\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:linecorp:line:*:*:*:*:*:iphone_os:*:*\",\"versionStartIncluding\":\"7.1.3\",\"versionEndIncluding\":\"7.15\",\"matchCriteriaId\":\"94094652-671E-4E1D-BE4A-D6FC6538B021\"}]}]}],\"references\":[{\"url\":\"https://jvn.jp/en/jp/JVN75453852/index.html\",\"source\":\"vultures@jpcert.or.jp\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://linecorp.com/en/security/article/136\",\"source\":\"vultures@jpcert.or.jp\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}

CVE-2018-0518

Vulnerability from jvndb

Published

2018-02-22 15:29

Modified

2018-06-14 12:23

Severity ?

4.8 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Summary

LINE for iOS fails to verify SSL server certificates

Details

LINE for iOS provided by LINE Corporation fails to verify SSL server certificates due to the vulnerability existed in the Third Party SDK which is incorporated in the application. LINE Corporation reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and LINE Corporation coordinated under the Information Security Early Warning Partnership.

References

▼	Type	URL
	JVN	http://jvn.jp/en/jp/JVN75453852/index.html
	CVE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0518
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2018-0518

Impacted products

▼	Vendor	Product
	LY Corporation	LINE

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2018/JVNDB-2018-000016.html",
  "dc:date": "2018-06-14T12:23+09:00",
  "dcterms:issued": "2018-02-22T15:29+09:00",
  "dcterms:modified": "2018-06-14T12:23+09:00",
  "description": "LINE for iOS provided by LINE Corporation fails to verify SSL server certificates due to the vulnerability existed in the Third Party SDK which is incorporated in the application.\r\n\r\nLINE Corporation reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and LINE Corporation coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2018/JVNDB-2018-000016.html",
  "sec:cpe": {
    "#text": "cpe:/a:linecorp:line",
    "@product": "LINE",
    "@vendor": "LY Corporation",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "4.0",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:H/Au:N/C:P/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "4.8",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2018-000016",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN75453852/index.html",
      "@id": "JVN#75453852",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0518",
      "@id": "CVE-2018-0518",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2018-0518",
      "@id": "CVE-2018-0518",
      "@source": "NVD"
    }
  ],
  "title": "LINE for iOS fails to verify SSL server certificates"
}

gsd-2018-0518

Vulnerability from gsd

Modified

2023-12-13 01:22

Details

Aliases

CVE-2018-0518

Aliases

CVE-2018-0518

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2018-0518",
    "description": "LINE for iOS version 7.1.3 to 7.1.5 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.",
    "id": "GSD-2018-0518"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2018-0518"
      ],
      "details": "LINE for iOS version 7.1.3 to 7.1.5 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.",
      "id": "GSD-2018-0518",
      "modified": "2023-12-13T01:22:24.259148Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "vultures@jpcert.or.jp",
        "ID": "CVE-2018-0518",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "LINE for iOS",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "version 7.1.3 to 7.1.5"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "LINE Corporation"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "LINE for iOS version 7.1.3 to 7.1.5 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Fails to verify SSL certificates"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://linecorp.com/en/security/article/136",
            "refsource": "MISC",
            "url": "https://linecorp.com/en/security/article/136"
          },
          {
            "name": "JVN#75453852",
            "refsource": "JVN",
            "url": "https://jvn.jp/en/jp/JVN75453852/index.html"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:linecorp:line:*:*:*:*:*:iphone_os:*:*",
                "cpe_name": [],
                "versionEndIncluding": "7.15",
                "versionStartIncluding": "7.1.3",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2018-0518"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "LINE for iOS version 7.1.3 to 7.1.5 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-295"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://linecorp.com/en/security/article/136",
              "refsource": "MISC",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://linecorp.com/en/security/article/136"
            },
            {
              "name": "JVN#75453852",
              "refsource": "JVN",
              "tags": [
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "https://jvn.jp/en/jp/JVN75453852/index.html"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "exploitabilityScore": 2.2,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2018-03-20T19:16Z",
      "publishedDate": "2018-02-23T15:29Z"
    }
  }
}

ghsa-h956-h9q8-3c53

Vulnerability from github

Published

2022-05-14 03:36

Modified

2022-05-14 03:36

Severity ?

5.9 (Medium) - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2018-0518"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-02-23T15:29:00Z",
    "severity": "MODERATE"
  },
  "details": "LINE for iOS version 7.1.3 to 7.1.5 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.",
  "id": "GHSA-h956-h9q8-3c53",
  "modified": "2022-05-14T03:36:42Z",
  "published": "2022-05-14T03:36:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0518"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN75453852/index.html"
    },
    {
      "type": "WEB",
      "url": "https://linecorp.com/en/security/article/136"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

Action not permitted

CVE-2018-0518

Vulnerability from cvelistv5

CVE-2018-0518

Vulnerability from jvndb

gsd-2018-0518

Vulnerability from gsd

ghsa-h956-h9q8-3c53

Vulnerability from github

Tags