Описание
Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| httpcomponents-client | not-affected | package |
Примечания
https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97
Fixed by: https://github.com/apache/httpcomponents-client/commit/1acf00b879d908a869508ceee2edb0fe65b69d73 (rel/5.6.1, 5.6.1-RC1)
EPSS
Связанные уязвимости
Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.
Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.
Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.
Apache HttpClient accepts SCRAM-SHA-256 authentication without proper mutual authentication verification
EPSS