When AdaCore Ada Web Server 25.0.0 is linked with GnuTLS, the default behaviour of AWS.Client is vulnerable to a man-in-the-middle attack because of lack of verification of an HTTPS servers certificate (unless the using program specifies a TLS configuration).
Weakness
The product does not validate, or incorrectly validates, a certificate.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Ada_web_server | Adacore | 25.0 (including) | 25.0 (including) |
| Libaws | Ubuntu | focal | * |