PT-2012-1252 · Apache+1 · Apache Commons Httpclient+1

Florian Weimer · Published 2012-11-20 · Updated 2018-10-17 · CVE-2012-6153

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache Commons HttpClient versions prior to 4.2.3

Description The issue is related to insufficient verification of input data in the Apache Commons HttpClient library, part of Apache HttpComponents. This allows a remote attacker to spoof SSL servers using a specially crafted certificate. The problem arises because the server hostname is not properly checked against the domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate. Specifically, the AbstractVerifier.java class does not correctly verify the server hostname when the common name is specified in a field other than the CN field.

Recommendations For versions prior to 4.2.3, update to version 4.2.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of SSL connections to trusted servers with properly validated certificates. Avoid using the AbstractVerifier.java class until a patch is applied.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2024-08709

CVE-2012-6153

DLA-222-1

GHSA-2X83-R56G-CV47

MGASA-2014-0347

MGASA-2014-0348

RHSA-2014:1098

RHSA-2014:1162

RHSA-2014:1320

RHSA-2014:1321

RHSA-2014:1833

RHSA-2014:1834

RHSA-2014:2019

RHSA-2015:0158

USN-2769-1

Affected Products

Apache Commons Httpclient

Ubuntu

References · 48

• http://svn.apache.org/viewvc?view=revision&revision=1411705 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-1098.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0347 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0765.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0720.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-3577 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2012-6153 · Security Note
• http://rhn.redhat.com/errata/RHSA-2014-1836.html · Vendor Advisory
• https://osv.dev/vulnerability/USN-2769-1 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0675.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-6153 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-6153 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-6153 · Security Note
• http://rhn.redhat.com/errata/RHSA-2015-0125.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-08709 · Security Note