description: In Eclipse Californium version 2.0.0 to 2.6.4 and 3.0.0-M1 to 3.0.0-M3, the certificate based (x509 and RPK) DTLS handshakes accidentally succeeds without verifying the server side's signature on the client side, if that signature is not included in the server's ServerKeyExchange.
problem types: CWE-322: Key Exchange without Entity Authentication
affected:
{
product: Eclipse Californium
vendor: The Eclipse Foundation
versions:
lessThan: unspecified, status: affected, version: 2.0.0, versionType: custom
lessThanOrEqual: 2.6.4, status: affected, version: unspecified, versionType: custom
lessThan: unspecified, status: affected, version: 3.0.0-M1, versionType: custom
lessThanOrEqual: 3.0.0-M3, status: affected, version: unspecified, versionType: custom
}