CVE-2012-5784
published 2012-11-04CVE-2012-5784: Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in…
PriorityP432medium5.8CVSS 2.0
AVNACMAuNCPIPAN
EPSS
5.72%
92.2th percentile
Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | activemq | <= 5.7.0 | — |
| apache | axis | <= 1.4 | — |
| apache | axis | — | — |
| apache | axis | — | — |
| apache | axis | — | — |
| apache | axis | — | — |
| apache | axis | — | — |
| apache | axis | >= 0 < 1.4-16.1 | 1.4-16.1 |
| apache | axis | >= 0 < 1.4-21 | 1.4-21 |
| apache | axis | >= 0 < 1.4-16.1 | 1.4-16.1 |
| apache | axis | >= 0 < 1.4-21 | 1.4-21 |
| apache | axis | >= 0 < 1.4-16.1 | 1.4-16.1 |
| apache | axis | >= 0 < 1.4-21 | 1.4-21 |
| apache | axis | >= 0 < 1.4-16.1 | 1.4-16.1 |
| apache | axis | >= 0 < 1.4-21 | 1.4-21 |
| debian | axis | < axis 1.4-16.1 (bookworm) | axis 1.4-16.1 (bookworm) |
| debian | axis | < axis 1.4-21 (bookworm) | axis 1.4-21 (bookworm) |
CVSS provenance
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
ghsa5.8MEDIUM
osv5.8MEDIUM
vendor_debian5.8LOW
vendor_redhat5.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Man-in-the-middle attack in Apache Axis
ghsa·2020-10-07
CVE-2012-5784 [MEDIUM] CWE-20 Man-in-the-middle attack in Apache Axis
Man-in-the-middle attack in Apache Axis
Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
OSV
Man-in-the-middle attack in Apache Axis
osv·2020-10-07
CVE-2012-5784 [MEDIUM] Man-in-the-middle attack in Apache Axis
Man-in-the-middle attack in Apache Axis
Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
OSV
Improper Validation of Certificates in apache axis
osv·2018-10-16·CVSS 5.8
CVE-2014-3596 [MEDIUM] Improper Validation of Certificates in apache axis
Improper Validation of Certificates in apache axis
The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.
GHSA
Improper Validation of Certificates in apache axis
ghsa·2018-10-16·CVSS 5.8
CVE-2014-3596 [MEDIUM] CWE-297 Improper Validation of Certificates in apache axis
Improper Validation of Certificates in apache axis
The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.
OSV
CVE-2014-3596: The getCN function in Apache Axis 1
osv·2014-08-27·CVSS 5.8
CVE-2014-3596 [MEDIUM] CVE-2014-3596: The getCN function in Apache Axis 1
The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.
OSV
CVE-2012-5784: Apache Axis 1
osv·2012-11-04·CVSS 5.8
CVE-2012-5784 [MEDIUM] CVE-2012-5784: Apache Axis 1
Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Red Hat
axis: SSL hostname verification bypass, incomplete CVE-2012-5784 fix
vendor_redhat·2014-08-19·CVSS 5.8
CVE-2014-3596 [MEDIUM] CWE-297 axis: SSL hostname verification bypass, incomplete CVE-2012-5784 fix
axis: SSL hostname verification bypass, incomplete CVE-2012-5784 fix
The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.
It was discovered that Axis incorrectly extracted the host name from an X.509 certificate subject's Common Name (CN) field. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.
Statement: Note that Axis 1 is EOL upstream, and
Debian
CVE-2014-3596: axis - The getCN function in Apache Axis 1.4 and earlier does not properly verify that ...
vendor_debian·2014·CVSS 5.8
CVE-2014-3596 [MEDIUM] CVE-2014-3596: axis - The getCN function in Apache Axis 1.4 and earlier does not properly verify that ...
The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.
Scope: local
bookworm: resolved (fixed in 1.4-21)
bullseye: resolved (fixed in 1.4-21)
forky: resolved (fixed in 1.4-21)
sid: resolved (fixed in 1.4-21)
trixie: resolved (fixed in 1.4-21)
Red Hat
axis: missing connection hostname check against X.509 certificate name
vendor_redhat·2012-10-16·CVSS 5.8
CVE-2012-5784 [MEDIUM] axis: missing connection hostname check against X.509 certificate name
axis: missing connection hostname check against X.509 certificate name
Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Apache Axis did not verify that the server host name matched the domain name in the subject's Common Name (CN) or subjectAltName field in X.509 certificates. This could allow a man-in-the-middle attacker to spoof an SSL server if they had a certificate that was valid for any domain na
Debian
CVE-2012-5784: axis - Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, Pa...
vendor_debian·2012·CVSS 5.8
CVE-2012-5784 [MEDIUM] CVE-2012-5784: axis - Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, Pa...
Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Scope: local
bookworm: resolved (fixed in 1.4-16.1)
bullseye: resolved (fixed in 1.4-16.1)
forky: resolved (fixed in 1.4-16.1)
sid: resolved (fixed in 1.4-16.1)
trixie: resolved (fixed in 1.4-16.1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2014-3596 axis: SSL hostname verification bypass, incomplete CVE-2012-5784 fix
bugzilla·2014-08-14·CVSS 5.8
CVE-2014-3596 [MEDIUM] CVE-2014-3596 axis: SSL hostname verification bypass, incomplete CVE-2012-5784 fix
CVE-2014-3596 axis: SSL hostname verification bypass, incomplete CVE-2012-5784 fix
It was found that the fix for CVE-2012-5784 was incomplete. The code added to check that the server hostname matches the domain name in the subject's CN field was flawed. This can be exploited by a Man-in-the-middle (MITM) attack where the attacker can spoof a valid certificate using a specially crafted subject.
Discussion:
Statement:
Note that Axis 1 is EOL upstream, and the incomplete patch for CVE-2012-5784 was never merged upstream. It was, however, shipped by various vendors, including Debian and Red Hat. Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1164433
Acknowledgements:
This issue was discovered by David Jorm and Arun Neelicattu
Bugzilla
CVE-2012-5784 axis: Does not verify that the server hostname matches a domain name in the subject's CN or subjectAltName field of the x.509 certificate [fedora-all]
bugzilla·2013-01-16·CVSS 5.8
CVE-2012-5784 [MEDIUM] CVE-2012-5784 axis: Does not verify that the server hostname matches a domain name in the subject's CN or subjectAltName field of the x.509 certificate [fedora-all]
CVE-2012-5784 axis: Does not verify that the server hostname matches a domain name in the subject's CN or subjectAltName field of the x.509 certificate [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in t
Bugzilla
CVE-2012-5784 axis: Does not verify that the server hostname matches a domain name in the subject's CN or subjectAltName field of the x.509 certificate [fedora-all]
bugzilla·2012-11-05·CVSS 5.8
CVE-2012-5784 [MEDIUM] CVE-2012-5784 axis: Does not verify that the server hostname matches a domain name in the subject's CN or subjectAltName field of the x.509 certificate [fedora-all]
CVE-2012-5784 axis: Does not verify that the server hostname matches a domain name in the subject's CN or subjectAltName field of the x.509 certificate [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in t
Bugzilla
CVE-2012-5784 axis: missing connection hostname check against X.509 certificate name
bugzilla·2012-11-05·CVSS 5.8
CVE-2012-5784 [MEDIUM] CVE-2012-5784 axis: missing connection hostname check against X.509 certificate name
CVE-2012-5784 axis: missing connection hostname check against X.509 certificate name
Common Vulnerabilities and Exposures assigned an identifier CVE-2012-5784 to the following vulnerability:
Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
References:
[1] http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
[2] https://crypto.stanford.edu/~dabo/pubs/abstracts/ssl-client-bugs.html
[3] http://www.sigsac.org/
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-06/msg00022.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0269.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0683.htmlhttp://rhn.redhat.com/errata/RHSA-2014-0037.htmlhttp://secunia.com/advisories/51219http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdfhttp://www.securityfocus.com/bid/56408https://exchange.xforce.ibmcloud.com/vulnerabilities/79829https://lists.apache.org/thread.html/44d4e88a5fa8ae60deb752029afe9054da87c5f859caf296fcf585e5%40%3Cjava-dev.axis.apache.org%3Ehttps://lists.apache.org/thread.html/5e6c92145deddcecf70c3604041dcbd615efa2d37632fc2b9c367780%40%3Cjava-dev.axis.apache.org%3Ehttps://lists.apache.org/thread.html/8aa25c99eeb0693fc229ec87d1423b5ed5d58558618706d8aba1d832%40%3Cjava-dev.axis.apache.org%3Ehttps://lists.apache.org/thread.html/a308887782e05da7cf692e4851ae2bd429a038570cbf594e6631cc8d%40%3Cjava-dev.axis.apache.org%3Ehttps://lists.apache.org/thread.html/de2af12dcaba653d02b03235327ca4aa930401813a3cced8e151d29c%40%3Cjava-dev.axis.apache.org%3Ehttp://lists.opensuse.org/opensuse-security-announce/2019-06/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-06/msg00022.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0269.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0683.htmlhttp://rhn.redhat.com/errata/RHSA-2014-0037.htmlhttp://secunia.com/advisories/51219http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdfhttp://www.securityfocus.com/bid/56408https://exchange.xforce.ibmcloud.com/vulnerabilities/79829https://lists.apache.org/thread.html/44d4e88a5fa8ae60deb752029afe9054da87c5f859caf296fcf585e5%40%3Cjava-dev.axis.apache.org%3Ehttps://lists.apache.org/thread.html/5e6c92145deddcecf70c3604041dcbd615efa2d37632fc2b9c367780%40%3Cjava-dev.axis.apache.org%3Ehttps://lists.apache.org/thread.html/8aa25c99eeb0693fc229ec87d1423b5ed5d58558618706d8aba1d832%40%3Cjava-dev.axis.apache.org%3Ehttps://lists.apache.org/thread.html/a308887782e05da7cf692e4851ae2bd429a038570cbf594e6631cc8d%40%3Cjava-dev.axis.apache.org%3Ehttps://lists.apache.org/thread.html/de2af12dcaba653d02b03235327ca4aa930401813a3cced8e151d29c%40%3Cjava-dev.axis.apache.org%3E
2012-11-04
Published