CVE-2013-7397 Insufficient Verification of Data Authenticity in Async Http Client
MediumCVSS 4.3
EPSS 0.99%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, which allows man-in-the-middle attackers to spoof HTTPS servers by presenting an arbitrary certificate during use of a typical AHC configuration, as demonstrated by a configuration that does not send client certificates.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| com.ning/async-http-client(Maven) | < 1.9.0 | 1.9.0 |
| com.ning/async-http-client(Maven) | = 1.0.0 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.1.0 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.2.0 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.3.0 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.3.1 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.3.2 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.3.3 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.3.4 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.4.0 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.4.1 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.5.0 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.6.0 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.6.1 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.6.2 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.6.3 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.6.4 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.6.5 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.7.0 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.7.0-RC1 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.7.1 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.7.10 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.7.11 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.7.12 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.7.13 | No fix listed |
Show 65 more
| Product | Affected versions | Fixed in |
|---|---|---|
| com.ning/async-http-client(Maven) | = 1.7.14 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.7.15 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.7.16 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.7.17 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.7.18 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.7.19 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.7.2 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.7.20 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.7.21 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.7.22 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.7.23 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.7.24 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.7.24-jenkins-1 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.7.3 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.7.4 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.7.5 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.7.6 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.7.7 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.7.8 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.7.9 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.8.0 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.8.1 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.8.10 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.8.11 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.8.12 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.8.13 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.8.14 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.8.15 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.8.16 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.8.17 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.8.2 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.8.3 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.8.4 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.8.5 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.8.6 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.8.7 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.8.8 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.8.9 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.9.0-BETA1 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.9.0-BETA10 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.9.0-BETA11 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.9.0-BETA12 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.9.0-BETA13 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.9.0-BETA14 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.9.0-BETA15 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.9.0-BETA16 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.9.0-BETA17 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.9.0-BETA18 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.9.0-BETA19 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.9.0-BETA2 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.9.0-BETA20 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.9.0-BETA21 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.9.0-BETA22 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.9.0-BETA23 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.9.0-BETA24 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.9.0-BETA3 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.9.0-BETA4 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.9.0-BETA5 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.9.0-BETA6 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.9.0-BETA7 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.9.0-BETA8 | No fix listed |
| com.ning/async-http-client(Maven) | = 1.9.0-BETA9 | No fix listed |
| debian/async-http-client(Debian:12) | < 1.6.5-3 | 1.6.5-3 |
| redhat jboss fuse | <= 6.1.0 | No fix listed |
| async-http-client project async-http-client | <= 1.9.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com vendor-advisory
- github.com patch
- github.com product
- lists.apache.org
- lists.apache.org
- wiki.jenkins-ci.org
- [oss-security] 20140825 Re: CVE Request: Multiple issues in com.ning:async-http-client mailing-list
- RHSA-2015:0850 vendor-advisory
- RHSA-2015:0851 vendor-advisory
- RHSA-2015:1176 vendor-advisory
- RHSA-2015:1551 vendor-advisory
- github.com
- Debian Security Tracker CVE-2013-7397 vendor-advisory
- 69316 vdb-entry
- [pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1 mailing-list
- [pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list mailing-list