PT-2015-2595 · Apache+2 · Apache Httpcomponents Httpclient+2

Florian Weimer · Published 2015-09-30 · Updated 2024-06-15 · CVE-2015-5262

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Apache HttpComponents HttpClient versions prior to 4.3.6

Description The issue is related to the http/conn/ssl/SSLConnectionSocketFactory.java component in Apache HttpComponents HttpClient, which ignores the http.socket.timeout parameter during the SSL handshake procedure. This can be exploited by a remote attacker to cause a denial of service, resulting in an HTTPS call hang. The estimated number of potentially affected devices and details about real-world incidents are not specified.

Recommendations For versions prior to 4.3.6, update to version 4.3.6 or later to resolve the issue. As a temporary workaround, consider restricting the use of the SSLConnectionSocketFactory.java component until a patch is available. Avoid using the http.socket.timeout configuration setting in the affected API endpoint until the issue is resolved.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

BDU:2015-11960

CVE-2015-5262

DLA-322-1

GHSA-FMJ5-WV96-R2CH

MGASA-2015-0392

OPENSUSE-SU-2020:1873-1

OPENSUSE-SU-2020:1875-1

OPENSUSE-SU-2020_1873-1

OPENSUSE-SU-2020_1875-1

OPENSUSE-SU-2024:10621-1

SUSE-SU-2020:3149-1

SUSE-SU-2020:3151-1

SUSE-SU-2020:3152-1

USN-2769-1

Affected Products

Apache Httpcomponents Httpclient

Suse

Ubuntu

References · 64

• https://nvd.nist.gov/vuln/detail/CVE-2015-5262 · Security Note
• https://issues.apache.org/jira/browse/HTTPCLIENT-1478 · Vendor Advisory
• https://osv.dev/vulnerability/USN-2769-1 · Vendor Advisory
• http://ubuntu.com/usn/USN-2769-1 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167999.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2015-0392 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2015-0392.html · Security Note
• https://osv.dev/vulnerability/GHSA-fmj5-wv96-r2ch · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2015-5262 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-5262 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2769-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-3577 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-5262 · Vendor Advisory
• https://ubuntu.com/security/CVE-2012-6153 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00033.html · Vendor Advisory