CVE-2012-5783

CWE-295 — Improper Certificate ValidationCWE-297CWE-20 — Improper Input Validation18 documents8 sources
Severity
5.8MEDIUM
EPSS
0.6%
top 30.10%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache HttpclientCanonical Ubuntu Linux
Timeline
PublishedNov 4
Latest updateMay 13

Description

Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

CVSS vector

AV:N/AC:M/C:P/I:P/A:NExploitability: 8.6 | Impact: 4.9

Affected Packages4 packages

▶Debiancommons-httpclient< 3.1-10.1+3
▶Ubuntucommons-httpclient< 3.1-10.2ubuntu0.14.04.1

Also affects: Ubuntu Linux 12.04, 14.04, 15.04

Patches

Patch: issues.apache.org ↗Patch: issues.apache.org ↗

🔴Vulnerability Details

6
OSV
Improper Certificate Validation in Apache Commons HttpClient↗2022-05-13
▶
GHSA
Improper Certificate Validation in Apache Commons HttpClient↗2022-05-13
▶
GHSA
Improper certificate validation in org.apache.httpcomponents:httpclient↗2018-10-17
▶
OSV
commons-httpclient vulnerabilities↗2015-10-14
▶
OSV
CVE-2012-5783: Apache Commons HttpClient 3↗2012-11-04
▶

📋Vendor Advisories

3
Ubuntu
Apache Commons HttpClient vulnerabilities↗2015-10-14
▶
Red Hat
jakarta-commons-httpclient: missing connection hostname check against X.509 certificate name↗2012-10-16
▶
Debian
CVE-2012-5783: commons-httpclient - Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS)...↗2012
▶

💬Community

7
Bugzilla
CVE-2014-3603 OpenSAML Java: HTTPS Connections Via HTTP Resources Do Not Perform Hostname Verification↗2014-08-20
▶
Bugzilla
CVE-2012-6153 Apache HttpComponents client / Apache CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix↗2014-08-14
▶
Bugzilla
CVE-2012-5783 jakarta-commons-httpclient: missing connection hostname check against X.509 certificate name [fedora-all]↗2014-01-16
▶
Bugzilla
jakarta-commons-httpclient: Wildcard matching in SSL hostname verifier incorrect (a different issue than CVE-2012-5783)↗2013-02-12
▶
Bugzilla
jakarta-commons-httpclient: Wildcard matching in SSL hostname verifier incorrect (a different issue than CVE-2012-5783) [fedora-all]↗2013-02-12
▶
CVE-2012-5783 (MEDIUM CVSS 5.8) | Apache Commons HttpClient 3.x | cvebase.io