ada_web_services vulnerabilities

2 known vulnerabilities in ada_web_services from Adacore. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  ada_web_services: Use of Insufficiently Random Values

  CVE-2024-41708Sep 25, 2024Adacore

  An issue was discovered in AdaCore ada_web_services 20.0 allows an attacker to escalate privileges and steal sessions via the Random_String() function in the src/core/aws-utils.adb module.

• 7.4 High severity

  ada_web_services: Improper Validation of Certificate with Host Mismatch

  CVE-2024-37015Aug 13, 2024Adacore

  An issue was discovered in Ada Web Server 20.0. When configured to use SSL (which is not the default setting), the SSL/TLS used to establish connections to external services is done without proper hostname validation. This is exploitable by man-in-the-middle a