CVE-2012-6153: Input Validation

Q: What is the vulnerability ID of this issue?

The vulnerability ID of this issue is CVE-2012-6153.

Q: What is the severity of CVE-2012-6153?

The severity of CVE-2012-6153 is high with a score of 4.3.

Q: What is the affected software?

The affected software includes jakarta-commons-httpclient, jboss-seam2, apache-cxf, devtoolset, httpcomponents-client, Apache Commons-httpclient, IBM ISAM, and IBM Security Verify Access.

Q: What is the fix for CVE-2012-6153?

There is no specific fix mentioned in the provided information, but it is recommended to update to the latest version of the affected software.

Q: Where can I find more information about CVE-2012-6153?

You can find more information about CVE-2012-6153 on CVE website (https://www.cve.org/CVERecord?id=CVE-2012-6153) and NVD website (https://nvd.nist.gov/vuln/detail/CVE-2012-6153).

Published Aug 14, 2014

Updated

http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5783.

Other sources

It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject's Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.

It was found that the fix for CVE-2012-5783 was incomplete. The code added to check that the server hostname matches the domain name in the subject's CN field was flawed. This can be exploited by a Man-in-the-middle (MITM) attack, where the attacker can spoof a valid certificate using a specially crafted subject.

— Red Hat

Affected Software

24 affected componentsFixes available

redhat/jakarta-commons-httpclient<1:3.1-4_patch_02.ep5.el5

1:3.1-4_patch_02.ep5.el5

redhat/jboss-seam2<0:2.2.6.EAP5-22_patch_01.ep5.el5

0:2.2.6.EAP5-22_patch_01.ep5.el5

redhat/apache-cxf<0:2.2.12-14.patch_09.ep5.el5

0:2.2.12-14.patch_09.ep5.el5

redhat/jakarta-commons-httpclient<1:3.1-4_patch_02.el6_5

1:3.1-4_patch_02.el6_5

redhat/jboss-seam2<0:2.2.6.EAP5-22_patch_01.el6

0:2.2.6.EAP5-22_patch_01.el6

redhat/apache-cxf<0:2.2.12-14.patch_09.el6

0:2.2.12-14.patch_09.el6

redhat/devtoolset<2-httpcomponents-client-0:4.2.1-6.el6

2-httpcomponents-client-0:4.2.1-6.el6

redhat/jakarta-commons-httpclient<1:3.1-4_patch_02.ep5.el4

1:3.1-4_patch_02.ep5.el4

redhat/jboss-seam2<0:2.2.6.EAP5-22_patch_01.ep5.el4

0:2.2.6.EAP5-22_patch_01.ep5.el4

redhat/apache-cxf<0:2.2.12-14.patch_09.ep5.el4

0:2.2.12-14.patch_09.ep5.el4

redhat/httpcomponents-eap6<0:6-12.redhat_2.1.ep6.el5

0:6-12.redhat_2.1.ep6.el5

redhat/apache-cxf<0:2.7.12-1.SP1_redhat_5.1.ep6.el5

0:2.7.12-1.SP1_redhat_5.1.ep6.el5

redhat/wss4j<0:1.6.16-2.redhat_3.1.ep6.el5

0:1.6.16-2.redhat_3.1.ep6.el5

redhat/httpcomponents-eap6<0:6-12.redhat_2.1.ep6.el6

0:6-12.redhat_2.1.ep6.el6

redhat/apache-cxf<0:2.7.12-1.SP1_redhat_5.1.ep6.el6

0:2.7.12-1.SP1_redhat_5.1.ep6.el6

redhat/wss4j<0:1.6.16-2.redhat_3.1.ep6.el6

0:1.6.16-2.redhat_3.1.ep6.el6

redhat/httpcomponents-eap6<0:6-12.redhat_2.1.ep6.el7

0:6-12.redhat_2.1.ep6.el7

redhat/apache-cxf<0:2.7.12-1.SP1_redhat_5.1.ep6.el7

0:2.7.12-1.SP1_redhat_5.1.ep6.el7

redhat/wss4j<0:1.6.16-2.redhat_3.1.ep6.el7

0:1.6.16-2.redhat_3.1.ep6.el7

maven/org.apache.httpcomponents:httpclient<4.2.3

4.2.3

redhat/httpcomponents-client<4.2.3

4.2.3

Apache Commons-httpclient>=4.0<=4.2.2

IBM Engineering Requirements Management DOORS and DOORS Web Access<=9.7.2.1 - 9.7.2.11

IBM Engineering Requirements Management DOORS and DOORS Web Access<=9.6.1.1 - 9.6.1.13

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/jakarta-commons-httpclient to a version that resolves this vulnerability.
Fixed in 1:3.1-4_patch_02.ep5.el5
Upgrade
Upgrade redhat/jboss-seam2 to a version that resolves this vulnerability.
Fixed in 0:2.2.6.EAP5-22_patch_01.ep5.el5
Upgrade
Upgrade redhat/apache-cxf to a version that resolves this vulnerability.
Fixed in 0:2.2.12-14.patch_09.ep5.el5
Upgrade
Upgrade redhat/jakarta-commons-httpclient to a version that resolves this vulnerability.
Fixed in 1:3.1-4_patch_02.el6_5
Upgrade
Upgrade redhat/jboss-seam2 to a version that resolves this vulnerability.
Fixed in 0:2.2.6.EAP5-22_patch_01.el6
Upgrade
Upgrade redhat/apache-cxf to a version that resolves this vulnerability.
Fixed in 0:2.2.12-14.patch_09.el6
Upgrade
Upgrade redhat/devtoolset to a version that resolves this vulnerability.
Fixed in 2-httpcomponents-client-0:4.2.1-6.el6
Upgrade
Upgrade redhat/jakarta-commons-httpclient to a version that resolves this vulnerability.
Fixed in 1:3.1-4_patch_02.ep5.el4
Upgrade
Upgrade redhat/jboss-seam2 to a version that resolves this vulnerability.
Fixed in 0:2.2.6.EAP5-22_patch_01.ep5.el4
Upgrade
Upgrade redhat/apache-cxf to a version that resolves this vulnerability.
Fixed in 0:2.2.12-14.patch_09.ep5.el4
Upgrade
Upgrade redhat/httpcomponents-eap6 to a version that resolves this vulnerability.
Fixed in 0:6-12.redhat_2.1.ep6.el5
Upgrade
Upgrade redhat/apache-cxf to a version that resolves this vulnerability.
Fixed in 0:2.7.12-1.SP1_redhat_5.1.ep6.el5
Upgrade
Upgrade redhat/wss4j to a version that resolves this vulnerability.
Fixed in 0:1.6.16-2.redhat_3.1.ep6.el5
Upgrade
Upgrade redhat/httpcomponents-eap6 to a version that resolves this vulnerability.
Fixed in 0:6-12.redhat_2.1.ep6.el6
Upgrade
Upgrade redhat/apache-cxf to a version that resolves this vulnerability.
Fixed in 0:2.7.12-1.SP1_redhat_5.1.ep6.el6
Upgrade
Upgrade redhat/wss4j to a version that resolves this vulnerability.
Fixed in 0:1.6.16-2.redhat_3.1.ep6.el6
Upgrade
Upgrade redhat/httpcomponents-eap6 to a version that resolves this vulnerability.
Fixed in 0:6-12.redhat_2.1.ep6.el7
Upgrade
Upgrade redhat/apache-cxf to a version that resolves this vulnerability.
Fixed in 0:2.7.12-1.SP1_redhat_5.1.ep6.el7
Upgrade
Upgrade redhat/wss4j to a version that resolves this vulnerability.
Fixed in 0:1.6.16-2.redhat_3.1.ep6.el7
Upgrade
Upgrade maven/org.apache.httpcomponents:httpclient to a version that resolves this vulnerability.
Fixed in 4.2.3
Upgrade
Upgrade redhat/httpcomponents-client to a version that resolves this vulnerability.
Fixed in 4.2.3
Upgrade
Upgrade http/conn/ssl/AbstractVerifier.java (Apache Commons HttpClient) to a version that resolves this vulnerability.
Fixed in 4.2.3
Compensating control
Mitigate potential Man-in-the-middle (MITM) spoofing risk by restricting outbound HTTPS traffic to trusted endpoints (e.g., enforce egress filtering / allowlist destinations or use an SSL/TLS-terminating proxy with certificate validation) until the HttpClient upgrade is applied.

Event History

Aug 14, 2014

CVE Published

12:00 AM

Sep 4, 2014

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Oct 17, 2018

Advisory Published

via GitHub·12:05 AM

Jul 6, 2026

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is the vulnerability ID of this issue?