org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field.
CVSS Details
- CVSS 3.1 Base Score: 4.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade jakarta-commons-httpclient-demoUpgrade httpcomponents-client-javadocUpgrade jakarta-commons-httpclientUpgrade jakarta-commons-httpclient-manualUpgrade jakarta-commons-httpclient-javadocUpgrade httpcomponents-client | Dec 1, 2016 | Aug 21, 2014 |
| Debian | — | Upgrade httpcomponents-clientUpgrade commons-httpclient | Jul 30, 2024 | Aug 21, 2014 |
| Freebsd | — | Upgrade jenkins-ltsUpgrade axis2Upgrade jenkins | Dec 10, 2025 | Oct 28, 2016 |
| Ibm Was | — | Upgrade to minimal fix pack levels as required by interim fixes and then apply latest Interim Fix. | Jul 2, 2021 | Aug 21, 2014 |
| Jenkins 2021 10 06 | — | Upgrade Jenkins to the latest versionUpgrade Jenkins LTS to version 2.303.2Upgrade Jenkins to version 2.315Upgrade Jenkins LTS to the latest version | Dec 2, 2021 | Aug 21, 2014 |
| Oracle_linux | — | Upgrade jakarta-commons-httpclientUpgrade jakarta-commons-httpclient-demoUpgrade httpcomponents-clientUpgrade httpcomponents-client-javadocUpgrade jakarta-commons-httpclient-manualUpgrade jakarta-commons-httpclient-javadoc | Jul 22, 2024 | Aug 18, 2014 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Aug 18, 2014 |
| Suse | — | Upgrade apache-commons-httpclient-demoUpgrade apache-commons-httpclientUpgrade apache-commons-httpclient-javadocUpgrade apache-commons-httpclient-manual | Nov 5, 2020 | Aug 21, 2014 |
| Ubuntu | — | Upgrade libcommons-httpclient-java | Nov 8, 2024 | Aug 21, 2014 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 21, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub