PT-2015-3575 · None · Async Http Client

Kishore Bhatia · Published 2015-05-11 · Updated 2022-05-13 · CVE-2013-7398

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Async Http Client versions prior to 1.9.0

Description The issue allows man-in-the-middle attackers to spoof HTTPS servers via an arbitrary valid certificate because it does not require a hostname match during verification of X.509 certificates.

Recommendations For versions prior to 1.9.0, update to version 1.9.0 or later to resolve the issue.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2013-7398

GHSA-5C66-6H6G-6Q6M

MGASA-2015-0212

Affected Products

Async Http Client

References · 21

• https://github.com/AsyncHttpClient/async-http-client/issues/197 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-7398 · Security Note
• http://rhn.redhat.com/errata/RHSA-2015-1176.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2015-0212 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0851.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5c66-6h6g-6q6m · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0850.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1551.html · Vendor Advisory
• https://lists.fedoraproject.org/pipermail/package-announce/2015-May/157337.html · Vendor Advisory
• https://advisories.mageia.org/MGASA-2015-0212.html · Security Note
• https://github.com/AsyncHttpClient/async-http-client · Note
• https://github.com/AsyncHttpClient/async-http-client/commit/a894583921c11c3b01f160ada36a8bb9d5158e9 · Note
• https://t.me/cvenotify/7147 · Telegram Post
• https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E · Note
• https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E · Note