Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2014-3577

Опубликовано: 18 авг. 2014
Источник: redhat
CVSS3: 4.8
CVSS2: 5.8

Описание

org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field.

It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject's Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.

Отчет

Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533 This issue affects the versions of HttpComponents Client as shipped with Red Hat JBoss Data Grid 6 and Red Hat JBoss Data Virtualization 6; and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Grid 6 and JBoss Data Virtualization 6. A future update may address this issue. Red Hat JBoss Enterprise Application Platform 4, Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ Fuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
OpenShift Enterprise 1jakarta-commons-httpclientWill not fix
OpenShift Enterprise 1wagon-httpNot affected
Red Hat Developer Toolset 2.1httpcomponents-clientNot affected
Red Hat Enterprise Virtualization 3redhat-support-plugin-rhevAffected
Red Hat Enterprise Virtualization 3rhevm-dependenciesAffected
Red Hat JBoss BRMS 5cxfAffected
Red Hat JBoss BRMS 5httpclientWill not fix
Red Hat JBoss BRMS 5jakarta-commons-httpclientWill not fix
Red Hat JBoss BRMS 5modeshape-clientWill not fix
Red Hat JBoss Data Grid 6cxfAffected

Показывать по

Дополнительная информация

Статус:

Important
Дефект:
CWE-297
https://bugzilla.redhat.com/show_bug.cgi?id=1129074CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix

4.8 Medium

CVSS3

5.8 Medium

CVSS2

Связанные уязвимости

ubuntu
около 11 лет назад

org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field.

nvd
около 11 лет назад

org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field.

debian
около 11 лет назад

org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents Htt ...

github
почти 7 лет назад

Improper Verification of Cryptographic Signature in org.apache.httpcomponents:httpclient

oracle-oval
почти 11 лет назад

ELSA-2014-1166: jakarta-commons-httpclient security update (IMPORTANT)

4.8 Medium

CVSS3

5.8 Medium

CVSS2