RHSA-2013:0270-01 -- Redhat jakarta-commons-httpclientID: oval:org.secpod.oval:def:500974 | Date: (C)2013-02-20 (M)2023-12-07 |
Class: PATCH | Family: unix |
The Jakarta Commons HttpClient component can be used to build HTTP-aware client applications . The Jakarta Commons HttpClient component did not verify that the server hostname matched the domain name in the subject"s Common Name or subjectAltName field in X.509 certificates. This could allow a man-in-the-middle attacker to spoof an SSL server if they had a certificate that was valid for any domain name. All users of jakarta-commons-httpclient are advised to upgrade to these updated packages, which correct this issue. Applications using the Jakarta Commons HttpClient component must be restarted for this update to take effect.
Platform: |
Red Hat Enterprise Linux 6 |
Red Hat Enterprise Linux 5 |
Product: |
jakarta-commons-httpclient |