CVE:CVE-2011-5242
CNNVD:CNNVD-201211-120
tmhOAuth是一款PHP写的OAuth 1.0A库。
tmhOAuth 0.61之前版本中存在漏洞，该漏洞源于在主题Common Name（CN）或X.509证书的subjectAltName字段中，程序没有对服务器主机名与域名的匹配进行校验。通过任意有效的证书，中间人攻击者可利用该漏洞欺骗SSL服务器。
solution:Upgrade themattharris tmhoauth to a higher version than 0.60,0.2,0.3,0.4,0.5,0.11,0.12,0.13,0.14,0.51,0.52,0.53,0.54,0.55,0.56,0.57,0.58,and avoid the version (,0.60],0.2,0.3,0.4,0.5,0.11,0.12,0.13,0.14,0.51,0.52,0.53,0.54,0.55,0.56,0.57,0.58