CVE-2012-6153 Improper certificate validation in org.apache.httpcomponents:httpclient
MediumCVSS 4.3
EPSS 5.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5783.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.httpcomponents/httpclient(Maven) | < 4.2.3 | 4.2.3 |
| org.apache.httpcomponents/httpclient(Maven) | = 4.0 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.0-alpha1 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.0-alpha2 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.0-alpha3 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.0-alpha4 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.0-beta1 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.0-beta2 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.0.1 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.0.2 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.0.3 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.1 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.1-alpha1 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.1-alpha2 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.1-beta1 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.1.1 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.1.2 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.1.3 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.2 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.2-alpha1 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.2-beta1 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.2.1 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.2.2 | No fix listed |
| debian/commons-httpclient(Debian:12) | < 3.1-10.2 | 3.1-10.2 |
| debian/commons-httpclient(Debian:13) | < 3.1-10.2 | 3.1-10.2 |
Show 2 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/commons-httpclient(Debian:14) | < 3.1-10.2 | 3.1-10.2 |
| apache commons-httpclient | >= 4.0, <= 4.2.2 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- access.redhat.com third-party-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory
- github.com vendor-advisory
- h20566.www2.hpe.com third-party-advisory
- RHSA-2014:1098 third-party-advisory vendor-advisory
- RHSA-2014:1833 third-party-advisory vendor-advisory
- RHSA-2014:1834 third-party-advisory vendor-advisory
- RHSA-2014:1835 third-party-advisory vendor-advisory
- RHSA-2014:1836 third-party-advisory vendor-advisory
- RHSA-2014:1891 third-party-advisory vendor-advisory
- RHSA-2014:1892 third-party-advisory vendor-advisory
- RHSA-2015:0125 third-party-advisory vendor-advisory
- RHSA-2015:0158 third-party-advisory vendor-advisory
- RHSA-2015:0675 third-party-advisory vendor-advisory
- RHSA-2015:0720 third-party-advisory vendor-advisory
- RHSA-2015:0765 third-party-advisory vendor-advisory
- RHSA-2015:0850 third-party-advisory vendor-advisory
- RHSA-2015:0851 third-party-advisory vendor-advisory
- RHSA-2015:1888 vendor-advisory
- svn.apache.org vendor-advisory
- USN-2769-1 third-party-advisory vendor-advisory
- Debian Security Tracker CVE-2012-6153 vendor-advisory
- 69257 third-party-advisory vdb-entry
- bugs.debian.org issue-tracking