Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2017-1000416: axTLS 1.5.3 misinterprets year 1950 as 2050
CVE-2017-1000416 · published 8 years ago
Summary
The axTLS library version 1.5.3 reads certain date values incorrectly, treating the year 1950 as 2050. This can cause software that relies on accurate dates—such as certificate expiration checks—to make wrong decisions. Upgrade to a newer axTLS release or apply the vendor’s patch to correct the date parsing.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| axtls_project | axtls |
1.5.3 cpe:2.3:a:axtls_project:axtls:1.5.3:*:*:*:*:*:*:* |
Original advisory text
axTLS version 1.5.3 has a coding error in the ASN.1 parser resulting in the year (19)50 of UTCTime being misinterpreted as 2050.
axTLS version 1.5.3 has a coding error in the ASN.1 parser resulting in the year (19)50 of UTCTime being misinterpreted as 2050.
References
- https://www.ieee-security.org/TC/SP2017/papers/231.pdf Technical Description Third Party Advisory
- https://www.youtube.com/watch?v=FW--c_F_cY8 Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-193Off-by-one Error
Timeline
Published22 Jan 2018
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2017-1000416 · NVD
Track software like this
Free during beta