CVE-2015-5262: Medium severity ubuntu vulnerability
http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.
Other sources
It was discovered that Apache HttpClient did not apply a configured connection or read timeout during the initial handshake of an HTTPS connection. As a result, HTTPS connection could get stuck, causing a denial of service if multiple such connections accumulate.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5262?
CVE-2015-5262 has been classified as a medium severity vulnerability due to the potential for denial of service during SSL handshakes.
How do I fix CVE-2015-5262?
To mitigate CVE-2015-5262, upgrade Apache HttpClient to version 4.3.6 or later.
What versions of Apache HttpClient are affected by CVE-2015-5262?
CVE-2015-5262 affects Apache HttpClient versions before 4.3.6.
Which operating systems are impacted by CVE-2015-5262?
CVE-2015-5262 impacts multiple versions of Ubuntu Linux and Fedora, specifically those using affected versions of Apache HttpClient.
What kind of attack does CVE-2015-5262 enable?
CVE-2015-5262 allows remote attackers to cause a denial of service by exploiting SSL handshake timeout issues.