PT-2014-2058 · Apache+4 · Apache Httpcomponents Httpclient+4
Publicado
2014-08-18
·
Atualizado
2024-06-15
·
CVE-2014-3577
CVSS v2.0
6.4
Média
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Apache HttpComponents HttpClient versions prior to 4.3.5
Apache HttpComponents HttpAsyncClient versions prior to 4.0.2
Description
The issue is related to improper verification of SSL/TLS certificate authentication in the Apache HttpClient client module of Apache HttpComponents. This could allow a remote attacker to spoof SSL servers by modifying the content in the distinguished name (DN) field. Specifically, the
AbstractVerifier in Apache HttpComponents HttpClient does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate. This allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate.Recommendations
For Apache HttpComponents HttpClient versions prior to 4.3.5, update to version 4.3.5 or later to resolve the issue.
For Apache HttpComponents HttpAsyncClient versions prior to 4.0.2, update to version 4.0.2 or later to resolve the issue.
As a temporary workaround, consider restricting the use of the
AbstractVerifier class until a patch is available.Exploit
Correção
Improper Verification of Cryptographic Signature
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Apache Httpcomponents Httpclient
Centos
Red Hat
Suse
Ubuntu