REDHAT-BUG-873317: Medium severity Apache Commons HttpClient vulnerability
Common Vulnerabilities and Exposures assigned an identifier CVE-2012-5783 to the following vulnerability:
Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via andaarbitrary valid certificate.
References: [1] http://www.cs.utexas.edu/~shmat/shmatccs12.pdf [2] https://crypto.stanford.edu/~dabo/pubs/abstracts/ssl-client-bugs.html [3] http://www.sigsac.org/ccs/CCS2012/techprogram.shtml
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-873317?
The severity of REDHAT-BUG-873317 is considered moderate due to potential issues with SSL/TLS certificate validation.
How do I fix REDHAT-BUG-873317?
To fix REDHAT-BUG-873317, update Apache Commons HttpClient to version 4.0 or later, which has addressed the vulnerability.
Which products are affected by REDHAT-BUG-873317?
REDHAT-BUG-873317 affects Apache Commons HttpClient version 3.x and Amazon Flexible Payments Service (FPS) merchant Java SDK.
What type of vulnerability is REDHAT-BUG-873317?
REDHAT-BUG-873317 is a vulnerability related to improper handling of SSL certificates in Apache Commons HttpClient.
Is there a workaround for REDHAT-BUG-873317?
A temporary workaround for REDHAT-BUG-873317 involves customizing the SSL configuration to enforce strict validation before making requests.