ALAS-2014-410 ---- jakarta-commons-httpclientID: oval:org.secpod.oval:def:1600140 | Date: (C)2016-01-19 (M)2023-12-07 |
Class: PATCH | Family: unix |
Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject"s Common Name or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject"s Common Name field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate. It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject"s Common Name field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.
Platform: |
Amazon Linux AMI |
Product: |
jakarta-commons-httpclient |