Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

The version of AIX installed on the remote host is prior to APAR IJ45224. It is, therefore, affected by a vulnerability as referenced in the IJ45224 advisory.

  - Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and     other products, does not verify that the server hostname matches a domain name in the subject's Common     Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to     spoof SSL servers via an arbitrary valid certificate. (CVE-2012-5783)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ44994. It is, therefore, affected by a vulnerability as referenced in the IJ44994 advisory.

  - Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and     other products, does not verify that the server hostname matches a domain name in the subject's Common     Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to     spoof SSL servers via an arbitrary valid certificate. (CVE-2012-5783)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ45221. It is, therefore, affected by a vulnerability as referenced in the IJ45221 advisory.

  - Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and     other products, does not verify that the server hostname matches a domain name in the subject's Common     Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to     spoof SSL servers via an arbitrary valid certificate. (CVE-2012-5783)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ44987. It is, therefore, affected by a vulnerability as referenced in the IJ44987 advisory.

  - Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and     other products, does not verify that the server hostname matches a domain name in the subject's Common     Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to     spoof SSL servers via an arbitrary valid certificate. (CVE-2012-5783)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The IBM WebSphere Application Server running on the remote host is version 7.0.0.x through 7.0.0.45, 8.0.0.x through 8.0.0.15, 8.5.0.x prior to 8.5.5.14 or 9.0.x prior to 9.0.0.8. It is, therefore, affected by an information disclosure vulnerability in the Apache Commons HttpClient subcomponent due to the failure to  verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate. An unauthenticated, remote attacker can exploit this to conduct spoofing attacks, by persuading a victim to visit a web site containing a specially-crafted certificate.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the commons package has been released.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2769-1 advisory.

    It was discovered that Apache Commons HttpClient did not properly verify the Common Name or subjectAltName     fields of X.509 certificates. An attacker could exploit this to perform a machine-in-the-middle attack to     view sensitive information or alter encrypted communications. This issue only affected Ubuntu 12.04 LTS.
    (CVE-2012-5783)

    Florian Weimer discovered the fix for CVE-2012-5783 was incomplete for Apache Commons HttpClient. An     attacker could exploit this to perform a machine-in-the-middle attack to view sensitive information or     alter encrypted communications. This issue only affected Ubuntu 12.04 LTS. (CVE-2012-6153)

    Subodh Iyengar and Will Shackleton discovered the fix for CVE-2012-5783 was incomplete for Apache Commons     HttpClient. An attacker could exploit this to perform a machine-in-the-middle attack to view sensitive     information or alter encrypted communications. (CVE-2014-3577)

    It was discovered that Apache Commons HttpClient did not properly handle read timeouts during HTTPS     handshakes. A remote attacker could trigger this flaw to cause a denial of service. (CVE-2015-5262)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

CVE-2012-5783 and CVE-2012-6153 Apache Commons HttpClient 3.1 did not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. Thanks to Alberto Fernandez Martinez for the patch.

CVE-2014-3577 It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject's Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate. The fix for CVE-2012-6153 was intended to address the incomplete patch for CVE-2012-5783. The issue is now completely resolved by applying this patch and the one for the previous CVEs

This upload was prepared by Markus Koschany.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An updated redhat-support-plugin-rhev package that fixes one security issue is now available.

The Red Hat Security Response Team has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The Red Hat Support plug-in for Red Hat Enterprise Virtualization is a new feature which offers seamless integrated access to Red Hat Access services from the Red Hat Enterprise Virtualization Administration Portal. The plug-in provides automated functionality that enables quicker help, answers, and proactive services. It offers easy and instant access to Red Hat exclusive knowledge, resources, engagement, and diagnostic features.

Detailed information about this plug-in can be found in the Red Hat Customer Portal at https://access.redhat.com/site/articles/425603

The Jakarta Commons HttpClient component did not verify that the server hostname matched the domain name in the subject's Common Name (CN) or subjectAltName field in X.509 certificates. This could allow a man-in-the-middle attacker to spoof an SSL server if they had a certificate that was valid for any domain name. (CVE-2012-5783)

All users of the Red Hat Support plug-in on Red Hat Enterprise Virtualization Manager are advised to install this updated package, which fixes this issue.

Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject's Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.

It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject's Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.

Security fix for CVE-2014-3577, CVE-2012-6153

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

jakarta-commons-httpclient3 was updated to enhance the fix of bnc#803332 / CVE-2012-5783 :

  - also add a check for subjectAltNames in certificates

jakarta-commons-httpclient was updated to enhance the fix of bnc#803332 / CVE-2012-5783

  - also check for subjectAltNames in the certificate.

jakarta-commons-httpclient3 was updated to add SSL certificate hostname checking. (CVE-2012-5783)

The Jakarta Commons HttpClient component did not verify that the server hostname matched the domain name in the subject's Common Name (CN) or subjectAltName field in X.509 certificates. This could allow a man-in-the-middle attacker to spoof an SSL server if they had a certificate that was valid for any domain name. (CVE-2012-5783)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-0270 advisory.

    [1:3.1-0.7]
    - Add missing connection hostname check against X.509 certificate name
    - Resolves: CVE-2012-5783

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The following issue has been fixed :

  - SSL certificate hostname verification was not done and     is fixed by this update. (CVE-2012-5783)

An updated jakarta-commons-httpclient package for JBoss Enterprise Application Platform 5.2.0 which fixes one security issue is now available for Red Hat Enterprise Linux 4, 5, and 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The Jakarta Commons HttpClient component can be used to build HTTP-aware client applications (such as web browsers and web service clients).

The Jakarta Commons HttpClient component did not verify that the server hostname matched the domain name in the subject's Common Name (CN) or subjectAltName field in X.509 certificates. This could allow a man-in-the-middle attacker to spoof an SSL server if they had a certificate that was valid for any domain name. (CVE-2012-5783)

Warning: Before applying this update, back up your existing JBoss Enterprise Application Platform installation (including all applications and configuration files).

All users of JBoss Enterprise Application Platform 5.2.0 on Red Hat Enterprise Linux 4, 5, and 6 are advised to upgrade to this updated package. The JBoss server process must be restarted for the update to take effect.

The Jakarta Commons HttpClient component did not verify that the server hostname matched the domain name in the subject's Common Name (CN) or subjectAltName field in X.509 certificates. This could allow a man-in-the- middle attacker to spoof an SSL server if they had a certificate that was valid for any domain name. (CVE-2012-5783)

Applications using the Jakarta Commons HttpClient component must be restarted for this update to take effect.

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2013:0270 advisory.

    The Jakarta Commons HttpClient component can be used to build HTTP-aware     client applications (such as web browsers and web service clients).

    The Jakarta Commons HttpClient component did not verify that the server     hostname matched the domain name in the subject's Common Name (CN) or     subjectAltName field in X.509 certificates. This could allow a     man-in-the-middle attacker to spoof an SSL server if they had a certificate     that was valid for any domain name. (CVE-2012-5783)

    All users of jakarta-commons-httpclient are advised to upgrade to these     updated packages, which correct this issue. Applications using the Jakarta     Commons HttpClient component must be restarted for this update to take     effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated jakarta-commons-httpclient packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The Jakarta Commons HttpClient component can be used to build HTTP-aware client applications (such as web browsers and web service clients).

The Jakarta Commons HttpClient component did not verify that the server hostname matched the domain name in the subject's Common Name (CN) or subjectAltName field in X.509 certificates. This could allow a man-in-the-middle attacker to spoof an SSL server if they had a certificate that was valid for any domain name. (CVE-2012-5783)

All users of jakarta-commons-httpclient are advised to upgrade to these updated packages, which correct this issue. Applications using the Jakarta Commons HttpClient component must be restarted for this update to take effect.

This update fixes a security vulnerability that caused jakarta-commons-httpclient not to verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allowed man-in-the-middle attackers to spoof SSL servers via andaarbitrary valid certificate (CVE-2012-5783).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
174446	AIX (IJ45224)	Nessus	AIX Local Security Checks	low
174444	AIX (IJ44994)	Nessus	AIX Local Security Checks	low
174442	AIX (IJ45221)	Nessus	AIX Local Security Checks	low
174439	AIX (IJ44987)	Nessus	AIX Local Security Checks	low
141917	IBM WebSphere Application Server 7.0.0.x <= 7.0.0.45 / 8.0.0.x <= 8.0.0.15 / 8.5.x < 8.5.5.14 / 9.0.x < 9.0.0.8 Information Disclosure (CVE-2012-5783)	Nessus	Web Servers	medium
140702	Photon OS 3.0: Commons PHSA-2020-3.0-0141	Nessus	PhotonOS Local Security Checks	medium
86401	Ubuntu 14.04 LTS : Apache Commons HttpClient vulnerabilities (USN-2769-1)	Nessus	Ubuntu Local Security Checks	medium
83545	Debian DLA-222-1 : commons-httpclient security update	Nessus	Debian Local Security Checks	medium
78999	RHEL 6 : redhat-support-plugin-rhev (RHSA-2014:0224)	Nessus	Red Hat Local Security Checks	medium
78353	Amazon Linux AMI : jakarta-commons-httpclient (ALAS-2014-410)	Nessus	Amazon Linux Local Security Checks	medium
77399	Fedora 20 : jakarta-commons-httpclient-3.1-15.fc20 (2014-9581)	Nessus	Fedora Local Security Checks	medium
77396	Fedora 19 : jakarta-commons-httpclient-3.1-15.fc19 (2014-9539)	Nessus	Fedora Local Security Checks	medium
74961	openSUSE Security Update : jakarta-commons-httpclient3 (openSUSE-SU-2013:0623-1)	Nessus	SuSE Local Security Checks	medium
74960	openSUSE Security Update : jakarta-commons-httpclient (openSUSE-SU-2013:0622-1)	Nessus	SuSE Local Security Checks	medium
74904	openSUSE Security Update : jakarta-commons-httpclient3 (openSUSE-SU-2013:0354-1)	Nessus	SuSE Local Security Checks	medium
69728	Amazon Linux AMI : jakarta-commons-httpclient (ALAS-2013-169)	Nessus	Amazon Linux Local Security Checks	medium
68731	Oracle Linux 5 / 6 : jakarta-commons-httpclient (ELSA-2013-0270)	Nessus	Oracle Linux Local Security Checks	low
65795	SuSE 11.2 Security Update : jakarta (SAT Patch Number 7574)	Nessus	SuSE Local Security Checks	medium
65677	RHEL 5 / 6 : jakarta-commons-httpclient (RHSA-2013:0680)	Nessus	Red Hat Local Security Checks	medium
64778	Scientific Linux Security Update : jakarta-commons-httpclient on SL5.x, SL6.x i386/x86_64 (20130219)	Nessus	Scientific Linux Local Security Checks	medium
64695	RHEL 5 / 6 : jakarta-commons-httpclient (RHSA-2013:0270)	Nessus	Red Hat Local Security Checks	low
64691	CentOS 5 : jakarta-commons-httpclient (CESA-2013:0270)	Nessus	CentOS Local Security Checks	medium
64409	Fedora 16 : jakarta-commons-httpclient-3.1-12.fc16 (2013-1289)	Nessus	Fedora Local Security Checks	medium
64404	Fedora 18 : jakarta-commons-httpclient-3.1-12.fc18 (2013-1203)	Nessus	Fedora Local Security Checks	medium
64402	Fedora 17 : jakarta-commons-httpclient-3.1-12.fc17 (2013-1189)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2012-5783

medium

Tenable Plugins

low

low

low

low

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

low

medium

medium

medium

low

medium

medium

medium

medium