CVE-2013-7398: Medium severity Async-http-client Project Async-http-client vulnerability
It was found that async-http-client did not verify that the server hostname matched the domain name in the subject's Common Name (CN) or subjectAltName field in X.509 certificates. This could allow a man-in-the-middle attacker to spoof an SSL server if they had a certificate that was valid for any domain name.
Other sources
main/java/com/ning/http/client/AsyncHttpClientConfig.java in Async Http Client (aka AHC or async-http-client) before 1.9.0 does not require a hostname match during verification of X.509 certificates, which allows man-in-the-middle attackers to spoof HTTPS servers via an arbitrary valid certificate.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-7398?
CVE-2013-7398 is considered to be a moderate severity vulnerability due to its potential for man-in-the-middle attacks.
How do I fix CVE-2013-7398?
To fix CVE-2013-7398, you should upgrade to version 1.9.0 or later of the async-http-client library.
What types of attacks are possible with CVE-2013-7398?
CVE-2013-7398 allows attackers to impersonate an SSL server through man-in-the-middle attacks by using a valid certificate.
What versions of async-http-client are affected by CVE-2013-7398?
Versions of async-http-client prior to 1.9.0 are affected by CVE-2013-7398.
Which software does CVE-2013-7398 impact?
CVE-2013-7398 impacts the async-http-client library and associated packages like Red Hat JBoss Fuse.