- Vulnerability/
- RHSA-2014:1082
RHSA-2014:1082: Important: thermostat1-httpcomponents-client security update
First published: Wed Aug 20 2014(Updated: )
Thermostat is a monitoring and instrumentation tool for the OpenJDK HotSpot<br>Java Virtual Machine (JVM) with support for monitoring multiple<br>JVM instances.<br>The httpcomponents-client package provides an HTTP agent implementation<br>that is used by Thermostat to visualize collected data in an HTTP-aware<br>client application.<br>It was found that the fix for CVE-2012-6153 was incomplete: the code added<br>to check that the server hostname matches the domain name in a subject's<br>Common Name (CN) field in X.509 certificates was flawed.<br>A man-in-the-middle attacker could use this flaw to spoof an SSL server<br>using a specially crafted X.509 certificate. (CVE-2014-3577)<br>For additional information on this flaw, refer to the Knowledgebase<br>article in the References section.<br>All thermostat1-httpcomponents-client users are advised to upgrade to these<br>updated packages, which contain a backported patch to correct this issue.<br>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/thermostat1-httpcomponents-client | <4.2.5-3.4.el6.1 | 4.2.5-3.4.el6.1 |
| redhat/thermostat1-httpcomponents-client | <4.2.5-3.4.el6.1 | 4.2.5-3.4.el6.1 |
| redhat/thermostat1-httpcomponents-client-javadoc | <4.2.5-3.4.el6.1 | 4.2.5-3.4.el6.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of RHSA-2014:1082?
The vulnerability RHSA-2014:1082 is classified as important.
How do I fix RHSA-2014:1082?
To fix RHSA-2014:1082, update the thermostat1-httpcomponents-client package to version 4.2.5-3.4.el6.1 or later.
Which software is affected by RHSA-2014:1082?
RHSA-2014:1082 affects the thermostat1-httpcomponents-client and its related packages.
What does RHSA-2014:1082 address?
RHSA-2014:1082 addresses vulnerabilities in the HTTP agent implementation used by Thermostat.
Is RHSA-2014:1082 related to Java Virtual Machine security?
Yes, RHSA-2014:1082 pertains to vulnerabilities impacting the monitoring tool for OpenJDK HotSpot Java Virtual Machine.
- collector/redhat-errata
- anchor-id/RHSA-2014:1082
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/title
- agent/type
- package-manager/redhat