Apache Axis2/C does not verify that the server hostname matches a domain name in the subjects Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Apache_axis2/c | Apache | - (including) | - (including) |
| Axis2c | Ubuntu | lucid | * |
| Axis2c | Ubuntu | precise | * |
| Axis2c | Ubuntu | quantal | * |
| Axis2c | Ubuntu | raring | * |
| Axis2c | Ubuntu | saucy | * |
| Axis2c | Ubuntu | trusty | * |
| Axis2c | Ubuntu | utopic | * |
| Axis2c | Ubuntu | vivid | * |