CVE-2014-3577 Improper Verification of Cryptographic Signature in org.apache.httpcomponents:httpclient
MediumCVSS 5.8
EPSS 9.2%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.httpcomponents/httpclient(Maven) | < 4.3.5 | 4.3.5 |
| org.apache.httpcomponents/httpclient(Maven) | = 4.0 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.0-alpha1 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.0-alpha2 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.0-alpha3 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.0-alpha4 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.0-beta1 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.0-beta2 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.0.1 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.0.2 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.0.3 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.1 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.1-alpha1 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.1-alpha2 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.1-beta1 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.1.1 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.1.2 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.1.3 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.2 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.2-alpha1 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.2-beta1 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.2.1 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.2.2 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.2.3 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.2.4 | No fix listed |
Show 18 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.httpcomponents/httpclient(Maven) | = 4.2.5 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.2.6 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.3 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.3-alpha1 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.3-beta1 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.3-beta2 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.3.1 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.3.2 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.3.3 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.3.4 | No fix listed |
| debian/commons-httpclient(Debian:12) | < 3.1-11 | 3.1-11 |
| debian/commons-httpclient(Debian:13) | < 3.1-11 | 3.1-11 |
| debian/commons-httpclient(Debian:14) | < 3.1-11 | 3.1-11 |
| debian/httpcomponents-client(Debian:12) | < 4.3.5-1 | 4.3.5-1 |
| debian/httpcomponents-client(Debian:13) | < 4.3.5-1 | 4.3.5-1 |
| debian/httpcomponents-client(Debian:14) | < 4.3.5-1 | 4.3.5-1 |
| apache httpclient | >= 4.0, <= 4.3.4 | No fix listed |
| apache httpasyncclient | >= 4.0, <= 4.0.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- svn.apache.org
- security.netapp.com
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- github.com product
- github.com vendor-advisory
- apache-cve20143577-spoofing(95327) third-party-advisory vdb-entry
- access.redhat.com third-party-advisory
- openSUSE-SU-2020:1873 vendor-advisory
- openSUSE-SU-2020:1875 vendor-advisory
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- RHSA-2014:1146 third-party-advisory vendor-advisory
- RHSA-2014:1166 third-party-advisory vendor-advisory
- RHSA-2014:1833 third-party-advisory vendor-advisory
- RHSA-2014:1834 third-party-advisory vendor-advisory
- RHSA-2014:1835 third-party-advisory vendor-advisory
- RHSA-2014:1836 third-party-advisory vendor-advisory
- RHSA-2014:1891 third-party-advisory vendor-advisory
- RHSA-2014:1892 third-party-advisory vendor-advisory
- RHSA-2015:0125 third-party-advisory vendor-advisory
- RHSA-2015:0158 third-party-advisory vendor-advisory
- RHSA-2015:0675 third-party-advisory vendor-advisory
- RHSA-2015:0720 third-party-advisory vendor-advisory
- RHSA-2015:0765 third-party-advisory vendor-advisory
- RHSA-2015:0850 third-party-advisory vendor-advisory
- RHSA-2015:0851 third-party-advisory vendor-advisory
- RHSA-2015:1176 third-party-advisory vendor-advisory
- RHSA-2015:1177 third-party-advisory vendor-advisory
- RHSA-2015:1888 third-party-advisory vendor-advisory
- RHSA-2016:1773 third-party-advisory vendor-advisory
- RHSA-2016:1931 third-party-advisory vendor-advisory
- 20140818 CVE-2014-3577: Apache HttpComponents client: Hostname verification susceptible to MITM attack exploit mailing-list third-party-advisory
- [oss-security] 20211006 Multiple vulnerabilities in Jenkins and Jenkins plugins mailing-list
- www.oracle.com
- USN-2769-1 third-party-advisory vendor-advisory
- Debian Security Tracker CVE-2014-3577 vendor-advisory
- 60466 third-party-advisory
- 60589 third-party-advisory
- 60713 third-party-advisory
- 110143 broken-link vdb-entry
- 69258 third-party-advisory vdb-entry
- 1030812 third-party-advisory vdb-entry
- h20566.www2.hpe.com third-party-advisory
- h20566.www2.hpe.com third-party-advisory
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities mailing-list
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- [cxf-commits] 20200319 svn commit: r1058035 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html mailing-list
- [cxf-commits] 20200116 svn commit: r1055336 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-12423.txt.asc security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html mailing-list
- [cxf-commits] 20201112 svn commit: r1067927 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2020-13954.txt.asc security-advisories.html mailing-list
- [cxf-commits] 20210402 svn commit: r1073270 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2021-22696.txt.asc security-advisories.html mailing-list
- [cxf-commits] 20210616 svn commit: r1075801 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2021-30468.txt.asc security-advisories.html mailing-list
- [cxf-commits] 20200401 svn commit: r1058573 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2020-1954.txt.asc security-advisories.html mailing-list
- bugs.debian.org issue-tracking