Rapid7 Vulnerability & Exploit Database

ELSA-2013-0270 Moderate: Oracle Linux jakarta-commons-httpclient security update

Free InsightVM Trial No credit card necessary

Watch Demo See how it all works

Back to Search

ELSA-2013-0270 Moderate: Oracle Linux jakarta-commons-httpclient security update

Severity

CVSS

(AV:N/AC:M/Au:N/C:P/I:P/A:N)

Published

11/04/2012

Created

07/25/2018

Added

02/21/2013

Modified

04/11/2019

Description

Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Solution(s)

oracle-linux-upgrade-jakarta-commons-httpclient
oracle-linux-upgrade-jakarta-commons-httpclient-demo
oracle-linux-upgrade-jakarta-commons-httpclient-javadoc
oracle-linux-upgrade-jakarta-commons-httpclient-manual

References

https://attackerkb.com/topics/cve-2012-5783
58073
CVE - 2012-5783
RHSA-2013:0270
RHSA-2013:0679
RHSA-2013:0680
RHSA-2013:0681
RHSA-2013:0682
RHSA-2013:1147
RHSA-2013:1853
RHSA-2014:0224
RHSA-2017:0868
http://oss.oracle.com/pipermail/el-errata/2013-February/003263.html
http://oss.oracle.com/pipermail/el-errata/2013-February/003270.html
79984

Advanced vulnerability management analytics and reporting.

Key Features

Free InsightVM Trial View All Features

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;