The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade jakarta-commons-httpclientUpgrade httpcomponents-client-javadocUpgrade jakarta-commons-httpclient-demoUpgrade jakarta-commons-httpclient-manualUpgrade jakarta-commons-httpclient-javadocUpgrade httpcomponents-client | Dec 1, 2016 | Aug 21, 2014 |
| Debian | — | Upgrade commons-httpclientUpgrade httpcomponents-client | Jul 30, 2024 | Aug 21, 2014 |
| Freebsd | — | Upgrade jenkins-ltsUpgrade axis2Upgrade jenkins | Dec 10, 2025 | Oct 28, 2016 |
| Ibm Was | — | Upgrade to minimal fix pack levels as required by interim fixes and then apply latest Interim Fix. | Jul 2, 2021 | Mar 21, 2016 |
| Jenkins 2021 10 06 | — | Upgrade Jenkins LTS to the latest versionUpgrade Jenkins LTS to version 2.303.2Upgrade Jenkins to version 2.315Upgrade Jenkins to the latest version | Dec 2, 2021 | Aug 21, 2014 |
| Oracle_linux | — | Upgrade jakarta-commons-httpclient-manualUpgrade jakarta-commons-httpclient-javadocUpgrade jakarta-commons-httpclientUpgrade httpcomponents-client-javadocUpgrade httpcomponents-clientUpgrade jakarta-commons-httpclient-demo | Jul 22, 2024 | Aug 18, 2014 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Aug 18, 2014 |
| Suse | — | Upgrade apache-commons-httpclient-javadocUpgrade apache-commons-httpclient-manualUpgrade apache-commons-httpclientUpgrade apache-commons-httpclient-demo | Nov 5, 2020 | Aug 21, 2014 |
| Ubuntu | — | Upgrade libcommons-httpclient-java | Nov 8, 2024 | Aug 21, 2014 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 21, 2014 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub