CVE-2012-6153 — Improper Input Validation in Commons-httpclient

CWE-20 — Improper Input ValidationCWE-295 — Improper Certificate ValidationCWE-300 — Channel Accessible by Non-EndpointCWE-297 — Improper Validation of Certificate with Host Mismatch28 documents9 sources
Severity
5.9MEDIUMNVD
NVD4.3GHSA5.8GHSA4.3OSV5.8OSV4.3
EPSS
1.2%
top 20.68%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
15
Apache Commons-httpclientDebian Commons-httpclientJenkins+12 more
Timeline
PublishedSep 4
Latest updateMay 14

Description

http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5783.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages16 packages

▶Debianapache/commons-httpclient< 3.1-10.2+3
▶NVDapache/commons-httpclient4.0 — 4.2.2
▶debiandebian/commons-httpclient< commons-httpclient 3.1-10.2 (bookworm)
▶NVDjenkins/maven2.17

🔴Vulnerability Details

10
GHSA
Improper Certificate Validation in Jenkins↗2022-05-14
▶
GHSA
Jenkins Swarm Plugin Client vulnerable to man-in-the-middle attacks↗2022-05-14
▶
OSV
Improper Certificate Validation in Jenkins↗2022-05-14
▶
OSV
Jenkins Swarm Plugin Client vulnerable to man-in-the-middle attacks↗2022-05-14
▶
GHSA
MitM on Jenkins Maven Plugin↗2022-05-14
▶

📋Vendor Advisories

7
Red Hat
jenkins-pugin-swarm: Swarm Plugin Client bundled vulnerable version of the commons-httpclient library (SECURITY-597)↗2017-10-11
▶
Jenkins
Jenkins Security Advisory 2017-10-11↗2017-10-11
▶
Red Hat
jenkins: Jenkins core bundled vulnerable version of the commons-httpclient library (SECURITY-555)↗2017-10-11
▶
Ubuntu
Apache Commons HttpClient vulnerabilities↗2015-10-14
▶
Red Hat
CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix↗2014-08-18
▶

📄Research Papers

1
arXiv
Impact assessment for vulnerabilities in open-source software libraries↗2015-04-21
▶

💬Community

6
Bugzilla
CVE-2017-1000402 jenkins-pugin-swarm: Swarm Plugin Client bundled vulnerable version of the commons-httpclient library (SECURITY-597)↗2017-10-13
▶
Bugzilla
CVE-2017-1000396 jenkins: Jenkins core bundled vulnerable version of the commons-httpclient library (SECURITY-555)↗2017-10-13
▶
Bugzilla
CVE-2014-3577 jakarta-commons-httpclient: SSL hostname verification bypass, incomplete CVE-2012-6153 fix [fedora-all]↗2014-08-18
▶
Bugzilla
CVE-2012-6153 Apache HttpComponents client / Apache CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix↗2014-08-14
▶
Bugzilla
CVE-2014-3577 Apache HttpComponents client / Apache CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix↗2014-08-12
▶