CVE-2013-4366 Hostname verification in Apache HttpClient 4.3 was disabled by default
CriticalCVSS 9.8
EPSS 3.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509HostnameVerifier is not null, which allows attackers to have unspecified impact via vectors involving hostname verification.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.httpcomponents/httpclient(Maven) | >= 4.3, < 4.3.1 | 4.3.1 |
| org.apache.httpcomponents/httpclient(Maven) | = 4.3 | No fix listed |
| debian/httpcomponents-client(Debian:12) | < 4.3.2-1 | 4.3.2-1 |
| debian/httpcomponents-client(Debian:13) | < 4.3.2-1 | 4.3.2-1 |
| debian/httpcomponents-client(Debian:14) | < 4.3.2-1 | 4.3.2-1 |
| apache httpclient | = 4.3 | No fix listed |
| apache httpclient | = 4.3-alpha1 | No fix listed |
| apache httpclient | = 4.3-beta1 | No fix listed |
| apache httpclient | = 4.3-beta2 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- svn.apache.org issue-tracking patch release-notes vendor-advisory
- www.apache.org issue-tracking release-notes vendor-advisory
- github.com
- Debian Security Tracker CVE-2013-4366 vendor-advisory