CyberRota Analysis
AI-GeneratedA vulnerability in the JSSTrustManager class of Java Security Services allows the acceptance of CA certificates lacking TRUSTED_CA flags, potentially enabling man-in-the-middle attacks on TLS connections. This flaw poses a risk particularly in non-default configurations where certificate revocation checking is disabled, as it may permit attackers to forge trusted certificates. Organizations using Java in environments with custom security configurations should prioritize addressing this issue to safeguard against potential exploitation.
Original NVD Description
A flaw was found in JSS (Java Security Services). The JSSTrustManager class does not verify NSS trust flags when validating CA certificates, allowing certificates present in the NSS database without TRUSTED_CA flags to be accepted as trust anchors for TLS connections. In non-default configurations where certificate revocation checking is disabled, this could allow a man-in-the-middle attacker to forge certificates accepted by PKI client connections.