CVE-2012-5783
published 2012-11-04CVE-2012-5783: Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname…
PriorityP336medium5.8CVSS 2.0
AVNACMAuNCPIPAN
EPSS
9.25%
94.8th percentile
Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | commons-httpclient | >= 0 < 3.1-10.2 | 3.1-10.2 |
| apache | commons-httpclient | >= 0 < 3.1-10.2 | 3.1-10.2 |
| apache | commons-httpclient | >= 0 < 3.1-10.2 | 3.1-10.2 |
| apache | commons-httpclient | >= 0 < 3.1-10.2 | 3.1-10.2 |
| apache | commons-httpclient | 4.0 – 4.2.2 | — |
| apache | httpclient | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | commons-httpclient | < commons-httpclient 3.1-10.2 (bookworm) | commons-httpclient 3.1-10.2 (bookworm) |
| debian | commons-httpclient | < commons-httpclient 3.1-10.1 (bookworm) | commons-httpclient 3.1-10.1 (bookworm) |
CVSS provenance
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
ghsa5.8MEDIUM
osv5.8MEDIUM
vendor_debian5.8MEDIUM
vendor_redhat5.8MEDIUM
vendor_ubuntu5.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Apache Commons HttpClient vulnerabilities
vendor_ubuntu·2015-10-14·CVSS 5.8
CVE-2012-5783 [MEDIUM] Apache Commons HttpClient vulnerabilities
Title: Apache Commons HttpClient vulnerabilities
Summary: Several security issues were fixed in commons-httpclient.
It was discovered that Apache Commons HttpClient did not properly verify the
Common Name or subjectAltName fields of X.509 certificates. An attacker could
exploit this to perform a machine-in-the-middle attack to view sensitive
information or alter encrypted communications. This issue only affected Ubuntu
12.04 LTS. (CVE-2012-5783)
Florian Weimer discovered the fix for CVE-2012-5783 was incomplete for Apache
Commons HttpClient. An attacker could exploit this to perform a
machine-in-the-middle attack to view sensitive information or alter
encrypted communications. This issue only affected Ubuntu 12.04 LTS.
(CVE-2012-6153)
Subodh Iyengar and Will Shackleton discovered the f
Red Hat
CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix
vendor_redhat·2014-08-14·CVSS 5.8
CVE-2012-6153 [MEDIUM] CWE-297 CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix
CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix
http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5783.
It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject's Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof
Red Hat
Java: HTTPS Connections Via HTTP Resources Do Not Perform Hostname Verification
vendor_redhat·2014-08-13·CVSS 5.8
CVE-2014-3603 [MEDIUM] CWE-297 Java: HTTPS Connections Via HTTP Resources Do Not Perform Hostname Verification
Java: HTTPS Connections Via HTTP Resources Do Not Perform Hostname Verification
The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth Identity Provider (IdP) before 2.4.1 and OpenSAML Java 2.6.2 do not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Statement: This issue did not affect the versions of OpenSAML Java as shipped with Red Hat JBoss Data Virtualization 6, Red Hat JBoss Data Grid 6, Red Hat JBoss Enterprise Application Platform 5 and 6, Red Hat JBoss JBoss Operations Network 3, and Red Hat JBoss Portal 6. These products use a version of Jakarta Commons HttpClient t
Red Hat
jakarta-commons-httpclient: missing connection hostname check against X.509 certificate name
vendor_redhat·2012-10-16·CVSS 5.8
CVE-2012-5783 [MEDIUM] jakarta-commons-httpclient: missing connection hostname check against X.509 certificate name
jakarta-commons-httpclient: missing connection hostname check against X.509 certificate name
Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
It was found that Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL ser
Debian
CVE-2012-6153: commons-httpclient - http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 do...
vendor_debian·2012·CVSS 5.8
CVE-2012-6153 [MEDIUM] CVE-2012-6153: commons-httpclient - http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 do...
http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5783.
Scope: local
bookworm: resolved (fixed in 3.1-10.2)
bullseye: resolved (fixed in 3.1-10.2)
forky: resolved (fixed in 3.1-10.2)
sid: resolved (fixed in 3.1-10.2)
trixie: resolved (fixed in 3.1-10.2)
Debian
CVE-2012-5783: commons-httpclient - Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS)...
vendor_debian·2012·CVSS 5.8
CVE-2012-5783 [MEDIUM] CVE-2012-5783: commons-httpclient - Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS)...
Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Scope: local
bookworm: resolved (fixed in 3.1-10.1)
bullseye: resolved (fixed in 3.1-10.1)
forky: resolved (fixed in 3.1-10.1)
sid: resolved (fixed in 3.1-10.1)
trixie: resolved (fixed in 3.1-10.1)
OSV
Improper Certificate Validation in Apache Commons HttpClient
osv·2022-05-13·CVSS 5.8
CVE-2012-5783 [MEDIUM] Improper Certificate Validation in Apache Commons HttpClient
Improper Certificate Validation in Apache Commons HttpClient
Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Note that the Commons HttpClient project is [end of life](https://hc.apache.org/httpclient-legacy/). It has been replaced by the Apache HttpComponents project in its [HttpClient](https://hc.apache.org/httpcomponents-client-5.4.x/) and [HttpCore](https://hc.apache.org/httpcomponents-core-5.3.x/) modules. CVE-2012-5783 has been patched in [v4.0](https://repo1.maven.org/mav
GHSA
Improper Certificate Validation in Apache Commons HttpClient
ghsa·2022-05-13·CVSS 5.8
CVE-2012-5783 [MEDIUM] CWE-295 Improper Certificate Validation in Apache Commons HttpClient
Improper Certificate Validation in Apache Commons HttpClient
Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Note that the Commons HttpClient project is [end of life](https://hc.apache.org/httpclient-legacy/). It has been replaced by the Apache HttpComponents project in its [HttpClient](https://hc.apache.org/httpcomponents-client-5.4.x/) and [HttpCore](https://hc.apache.org/httpcomponents-core-5.3.x/) modules. CVE-2012-5783 has been patched in [v4.0](https://repo1.maven.org/mav
GHSA
Improper certificate validation in org.apache.httpcomponents:httpclient
ghsa·2018-10-17·CVSS 5.8
CVE-2012-6153 [MEDIUM] CWE-20 Improper certificate validation in org.apache.httpcomponents:httpclient
Improper certificate validation in org.apache.httpcomponents:httpclient
http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5783.
OSV
Improper certificate validation in org.apache.httpcomponents:httpclient
osv·2018-10-17·CVSS 5.8
CVE-2012-6153 [MEDIUM] Improper certificate validation in org.apache.httpcomponents:httpclient
Improper certificate validation in org.apache.httpcomponents:httpclient
http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5783.
OSV
commons-httpclient vulnerabilities
osv·2015-10-14·CVSS 5.8
CVE-2012-5783 [MEDIUM] commons-httpclient vulnerabilities
commons-httpclient vulnerabilities
It was discovered that Apache Commons HttpClient did not properly verify the
Common Name or subjectAltName fields of X.509 certificates. An attacker could
exploit this to perform a machine-in-the-middle attack to view sensitive
information or alter encrypted communications. This issue only affected Ubuntu
12.04 LTS. (CVE-2012-5783)
Florian Weimer discovered the fix for CVE-2012-5783 was incomplete for Apache
Commons HttpClient. An attacker could exploit this to perform a
machine-in-the-middle attack to view sensitive information or alter
encrypted communications. This issue only affected Ubuntu 12.04 LTS.
(CVE-2012-6153)
Subodh Iyengar and Will Shackleton discovered the fix for CVE-2012-5783 was
incomplete for Apache Commons HttpClient. An attacker cou
OSV
CVE-2012-6153: http/conn/ssl/AbstractVerifier
osv·2014-09-04·CVSS 5.8
CVE-2012-6153 [MEDIUM] CVE-2012-6153: http/conn/ssl/AbstractVerifier
http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5783.
OSV
CVE-2012-5783: Apache Commons HttpClient 3
osv·2012-11-04·CVSS 5.8
CVE-2012-5783 [MEDIUM] CVE-2012-5783: Apache Commons HttpClient 3
Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2014-3603 OpenSAML Java: HTTPS Connections Via HTTP Resources Do Not Perform Hostname Verification
bugzilla·2014-08-20·CVSS 5.8
CVE-2014-3603 [MEDIUM] CVE-2014-3603 OpenSAML Java: HTTPS Connections Via HTTP Resources Do Not Perform Hostname Verification
CVE-2014-3603 OpenSAML Java: HTTPS Connections Via HTTP Resources Do Not Perform Hostname Verification
It was discovered that HttpResource and FileBackedHttpResource implementations in OpenSAML Java and Shibboleth IdP did not enable hostname verification when using TLS connections. Additionaly, OpenSAML Java makes use of Jakarta Commons HttpClient version 3.x, which does not perform verification of the server hostname against the server's X.508 certificate (CVE-2012-5783). This flaw can be exploited by a Man-in-the-middle (MITM) attack, where the attacker can spoof a valid certificate using a specially crafted subject.
Discussion:
References:
http://shibboleth.net/community/advisories/secadv_20140813.txt
Upstream Commits:
http://svn.shibboleth.net/view/java-opensaml2/branches/REL_2/s
Bugzilla
CVE-2014-3577 jakarta-commons-httpclient: SSL hostname verification bypass, incomplete CVE-2012-6153 fix [fedora-all]
bugzilla·2014-08-18·CVSS 4.3
CVE-2014-3577 [MEDIUM] CVE-2014-3577 jakarta-commons-httpclient: SSL hostname verification bypass, incomplete CVE-2012-6153 fix [fedora-all]
CVE-2014-3577 jakarta-commons-httpclient: SSL hostname verification bypass, incomplete CVE-2012-6153 fix [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue
Bugzilla
CVE-2012-6153 Apache HttpComponents client / Apache CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix
bugzilla·2014-08-14·CVSS 5.8
CVE-2012-6153 [MEDIUM] CVE-2012-6153 Apache HttpComponents client / Apache CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix
CVE-2012-6153 Apache HttpComponents client / Apache CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix
It was found that the fix for CVE-2012-5783 was incomplete. The code added to check that the server hostname matches the domain name in the subject's CN field was flawed. This can be exploited by a Man-in-the-middle (MITM) attack, where the attacker can spoof a valid certificate using a specially crafted subject.
Discussion:
Acknowledgements:
This issue was discovered by Florian Weimer of Red Hat Product Security.
---
Upstream Commit:
HttpClient/4.2.x Branch
http://svn.apache.org/viewvc?view=revision&revision=1411705
---
Affects:
org.apache.httpcomponents:httpclient This issue has been addressed in following products:
>
> Red Hat Software Collections 1 for Red H
Bugzilla
CVE-2014-3577 Apache HttpComponents client / Apache CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix
bugzilla·2014-08-12·CVSS 4.3
CVE-2014-3577 [MEDIUM] CVE-2014-3577 Apache HttpComponents client / Apache CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix
CVE-2014-3577 Apache HttpComponents client / Apache CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix
It was found that the fix for CVE-2012-6153 was incomplete. The code added to check that the server hostname matches the domain name in the subject's CN field was flawed. This can be exploited by a Man-in-the-middle (MITM) attack where the attacker can spoof a valid certificate using a specially crafted subject.
Discussion:
Statement:
Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533
This issue affects the versions of HttpComponents Client as shipped with Red Hat JBoss Data Grid 6 and Red Hat JBoss Data Virtualization 6; and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. Howeve
Bugzilla
CVE-2012-5783 jakarta-commons-httpclient: missing connection hostname check against X.509 certificate name [fedora-all]
bugzilla·2014-01-16·CVSS 5.8
CVE-2012-5783 [MEDIUM] CVE-2012-5783 jakarta-commons-httpclient: missing connection hostname check against X.509 certificate name [fedora-all]
CVE-2012-5783 jakarta-commons-httpclient: missing connection hostname check against X.509 certificate name [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field wh
Bugzilla
jakarta-commons-httpclient: Wildcard matching in SSL hostname verifier incorrect (a different issue than CVE-2012-5783)
bugzilla·2013-02-12·CVSS 5.8
CVE-2012-5783 [MEDIUM] jakarta-commons-httpclient: Wildcard matching in SSL hostname verifier incorrect (a different issue than CVE-2012-5783)
jakarta-commons-httpclient: Wildcard matching in SSL hostname verifier incorrect (a different issue than CVE-2012-5783)
Originally, Common Vulnerabilities and Exposures assigned an identifier CVE-2012-5783 to the following vulnerability:
Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Later it was found, that the SSL hostname verifier implementation (CVE-2012-5783 fix) contained a bug in wildcard matching:
[1] https://issues.apache.org/jira/browse/HTTPCLIENT-1255
which still
Bugzilla
jakarta-commons-httpclient: Wildcard matching in SSL hostname verifier incorrect (a different issue than CVE-2012-5783) [fedora-all]
bugzilla·2013-02-12·CVSS 5.8
CVE-2012-5783 [MEDIUM] jakarta-commons-httpclient: Wildcard matching in SSL hostname verifier incorrect (a different issue than CVE-2012-5783) [fedora-all]
jakarta-commons-httpclient: Wildcard matching in SSL hostname verifier incorrect (a different issue than CVE-2012-5783) [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi n
Bugzilla
CVE-2012-5783 jakarta-commons-httpclient: Does not verify that the server hostname matches a domain name in the subject's CN or subjectAltName field of the X.509 certificate [fedora-all]
bugzilla·2012-11-05·CVSS 5.8
CVE-2012-5783 [MEDIUM] CVE-2012-5783 jakarta-commons-httpclient: Does not verify that the server hostname matches a domain name in the subject's CN or subjectAltName field of the X.509 certificate [fedora-all]
CVE-2012-5783 jakarta-commons-httpclient: Does not verify that the server hostname matches a domain name in the subject's CN or subjectAltName field of the X.509 certificate [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CV
Bugzilla
CVE-2012-5783 jakarta-commons-httpclient: missing connection hostname check against X.509 certificate name
bugzilla·2012-11-05·CVSS 5.8
CVE-2012-5783 [MEDIUM] CVE-2012-5783 jakarta-commons-httpclient: missing connection hostname check against X.509 certificate name
CVE-2012-5783 jakarta-commons-httpclient: missing connection hostname check against X.509 certificate name
Common Vulnerabilities and Exposures assigned an identifier CVE-2012-5783 to the following vulnerability:
Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via andaarbitrary valid certificate.
References:
[1] http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
[2] https://crypto.stanford.edu/~dabo/pubs/abstracts/ssl-client-bugs.html
[3] http://www.sigsac.org/ccs/CCS2012/techprogram.shtml
Discussion:
Created jak
http://lists.opensuse.org/opensuse-updates/2013-02/msg00078.htmlhttp://lists.opensuse.org/opensuse-updates/2013-04/msg00040.htmlhttp://lists.opensuse.org/opensuse-updates/2013-04/msg00041.htmlhttp://lists.opensuse.org/opensuse-updates/2013-04/msg00053.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0270.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0679.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0680.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0681.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0682.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1147.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1853.htmlhttp://rhn.redhat.com/errata/RHSA-2014-0224.htmlhttp://www.cs.utexas.edu/~shmat/shmat_ccs12.pdfhttp://www.securityfocus.com/bid/58073http://www.ubuntu.com/usn/USN-2769-1https://access.redhat.com/errata/RHSA-2017:0868https://exchange.xforce.ibmcloud.com/vulnerabilities/79984https://issues.apache.org/jira/browse/HTTPCLIENT-1265http://lists.opensuse.org/opensuse-updates/2013-02/msg00078.htmlhttp://lists.opensuse.org/opensuse-updates/2013-04/msg00040.htmlhttp://lists.opensuse.org/opensuse-updates/2013-04/msg00041.htmlhttp://lists.opensuse.org/opensuse-updates/2013-04/msg00053.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0270.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0679.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0680.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0681.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0682.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1147.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1853.htmlhttp://rhn.redhat.com/errata/RHSA-2014-0224.htmlhttp://www.cs.utexas.edu/~shmat/shmat_ccs12.pdfhttp://www.securityfocus.com/bid/58073http://www.ubuntu.com/usn/USN-2769-1https://access.redhat.com/errata/RHSA-2017:0868https://exchange.xforce.ibmcloud.com/vulnerabilities/79984https://issues.apache.org/jira/browse/HTTPCLIENT-1265
2012-11-04
Published