REDHAT-BUG-1261538: Low severity apache commons httpclient vulnerability
It was discovered that Apache HttpClient did not apply a configured connection or read timeout during the initial handshake of an HTTPS connection. As a result, HTTPS connection could get stuck, causing a denial of service if multiple such connections accumulate.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1261538?
The severity of REDHAT-BUG-1261538 is considered high due to its potential to cause denial of service.
How do I fix REDHAT-BUG-1261538?
To fix REDHAT-BUG-1261538, update to the latest version of Apache HttpClient that addresses the timeout configuration issue.
What is the impact of REDHAT-BUG-1261538 on applications?
The impact of REDHAT-BUG-1261538 is that it can lead to application downtime due to accumulated stuck HTTPS connections.
Is REDHAT-BUG-1261538 specific to any version of Apache HttpClient?
Yes, REDHAT-BUG-1261538 affects versions of Apache HttpClient where timeout settings were not properly enforced during the HTTPS handshake.
Are there any workarounds for REDHAT-BUG-1261538?
A temporary workaround for REDHAT-BUG-1261538 is to limit the number of concurrent connections to mitigate the risk of denial of service.