CVE-2015-5262 Denial of service vulnerability in org.apache.httpcomponents:httpclient
MediumCVSS 4.3
EPSS 18.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.httpcomponents/httpclient(Maven) | < 4.3.6 | 4.3.6 |
| org.apache.httpcomponents/httpclient(Maven) | = 4.0 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.0-alpha1 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.0-alpha2 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.0-alpha3 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.0-alpha4 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.0-beta1 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.0-beta2 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.0.1 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.0.2 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.0.3 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.1 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.1-alpha1 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.1-alpha2 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.1-beta1 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.1.1 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.1.2 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.1.3 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.2 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.2-alpha1 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.2-beta1 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.2.1 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.2.2 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.2.3 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.2.4 | No fix listed |
Show 24 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.httpcomponents/httpclient(Maven) | = 4.2.5 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.2.6 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.3 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.3-alpha1 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.3-beta1 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.3-beta2 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.3.1 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.3.2 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.3.3 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.3.4 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.3.5 | No fix listed |
| debian/commons-httpclient(Debian:12) | < 3.1-12 | 3.1-12 |
| debian/commons-httpclient(Debian:13) | < 3.1-12 | 3.1-12 |
| debian/commons-httpclient(Debian:14) | < 3.1-12 | 3.1-12 |
| debian/httpcomponents-client(Debian:12) | < 4.3.6-1 | 4.3.6-1 |
| debian/httpcomponents-client(Debian:13) | < 4.3.6-1 | 4.3.6-1 |
| debian/httpcomponents-client(Debian:14) | < 4.3.6-1 | 4.3.6-1 |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 15.04 | No fix listed |
| fedoraproject fedora | = 21 | No fix listed |
| fedoraproject fedora | = 22 | No fix listed |
| fedoraproject fedora | = 23 | No fix listed |
| apache httpclient | >= 4.3, <= 4.3.5 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory
- github.com vendor-advisory
- issues.apache.org vendor-advisory
- jenkins.io third-party-advisory
- lists.apache.org
- lists.apache.org
- lists.apache.org
- FEDORA-2015-15590 third-party-advisory vendor-advisory
- FEDORA-2015-15589 third-party-advisory vendor-advisory
- FEDORA-2015-15588 third-party-advisory vendor-advisory
- openSUSE-SU-2020:1873 vendor-advisory
- openSUSE-SU-2020:1875 vendor-advisory
- svn.apache.org vendor-advisory
- www.oracle.com
- 1033743 third-party-advisory vdb-entry
- USN-2769-1 third-party-advisory vendor-advisory
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities mailing-list
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- Debian Security Tracker CVE-2015-5262 vendor-advisory
- bugs.debian.org issue-tracking