PT-2012-6095 · Apache+4 · Apache Httpcomponents Httpclient+5

Alberto Fernández · Published 2012-11-04 · Updated 2024-06-15 · CVE-2012-5783

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache Commons HttpClient versions 3.x

Description The issue arises from the failure to verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate. This allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. The vulnerability can be exploited by persuading a victim to visit a Web site containing a specially-crafted certificate, enabling attackers to conduct spoofing attacks using man-in-the-middle techniques.

Recommendations For Apache Commons HttpClient version 3.x, consider upgrading to a newer version of the Apache HttpComponents HttpClient module, such as version 4.0 or later, which has patched this issue. As a temporary workaround, restrict the use of SSL connections to trusted servers with verified certificates. Avoid using the vulnerable Apache Commons HttpClient version 3.x for sensitive transactions until a patch is applied or an upgrade is performed.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2012-5783

DLA-222-1

GHSA-3832-9276-X7GF

MGASA-2013-0199

OPENSUSE-SU-2024:10381-1

RHSA-2013:0270

RHSA-2013:0680

RHSA-2013:0682

RHSA-2013_0270

RHSA-2014:0224

SUSE-SU-2013_0610-1

USN-2769-1

Affected Products

Apache Commons Httpclient

Apache Httpcomponents Httpclient

Ibm Aix

Red Hat

Suse

Ubuntu

References · 40

• http://rhn.redhat.com/errata/RHSA-2013-0682.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0680.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-5783 · Security Note
• http://rhn.redhat.com/errata/RHSA-2013-0679.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2013-04/msg00041.html · Vendor Advisory
• https://advisories.mageia.org/MGASA-2013-0199.html · Security Note
• http://rhn.redhat.com/errata/RHSA-2013-1853.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-5262 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-5783 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0224.html · Vendor Advisory
• https://osv.dev/vulnerability/USN-2769-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-5783 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2013-0199 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10381-1 · Vendor Advisory
• https://issues.apache.org/jira/browse/HTTPCLIENT-1265 · Vendor Advisory