CVE-2014-3577
published 2014-08-21CVE-2014-3577: org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the…
PriorityP335medium5.8CVSS 2.0
AVNACMAuNCPIPAN
EPSS
9.15%
94.7th percentile
org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | httpasyncclient | 4.0 – 4.0.1 | — |
| apache | httpclient | 4.0 – 4.3.4 | — |
| debian | commons-httpclient | < commons-httpclient 3.1-11 (bookworm) | commons-httpclient 3.1-11 (bookworm) |
| debian | httpcomponents-client | < commons-httpclient 3.1-11 (bookworm) | commons-httpclient 3.1-11 (bookworm) |
| jenkins | git_plugin | — | — |
| jenkins | jenkins_core | — | — |
| jenkins | jenkins_lts | — | — |
| jenkins | jenkins_weekly | — | — |
CVSS provenance
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
osv5.8MEDIUM
vendor_debian5.8MEDIUM
vendor_ubuntu5.8MEDIUM
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Jenkins
Jenkins Security Advisory 2021-10-06
vendor_jenkins·2021-10-06·CVSS 5.8
CVE-2014-3577 [MEDIUM] Jenkins Security Advisory 2021-10-06
Title: Jenkins Security Advisory 2021-10-06
Jenkins Security Advisory 2021-10-06
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Jenkins (core)
Git
Plugin
Descriptions
Improper handling of equivalent directory names on Windows
SECURITY-2424
/
CVE-2021-21682
Severity (CVSS):
Medium
Description:
Jenkins
Ubuntu
Apache Commons HttpClient vulnerabilities
vendor_ubuntu·2015-10-14·CVSS 5.8
CVE-2012-5783 [MEDIUM] Apache Commons HttpClient vulnerabilities
Title: Apache Commons HttpClient vulnerabilities
Summary: Several security issues were fixed in commons-httpclient.
It was discovered that Apache Commons HttpClient did not properly verify the
Common Name or subjectAltName fields of X.509 certificates. An attacker could
exploit this to perform a machine-in-the-middle attack to view sensitive
information or alter encrypted communications. This issue only affected Ubuntu
12.04 LTS. (CVE-2012-5783)
Florian Weimer discovered the fix for CVE-2012-5783 was incomplete for Apache
Commons HttpClient. An attacker could exploit this to perform a
machine-in-the-middle attack to view sensitive information or alter
encrypted communications. This issue only affected Ubuntu 12.04 LTS.
(CVE-2012-6153)
Subodh Iyengar and Will Shackleton discovered the f
Red Hat
CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix
vendor_redhat·2014-08-18·CVSS 4.3
CVE-2014-3577 [MEDIUM] CWE-297 CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix
CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix
org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field.
It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject's Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could
Debian
CVE-2014-3577: commons-httpclient - org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient be...
vendor_debian·2014·CVSS 5.8
CVE-2014-3577 [MEDIUM] CVE-2014-3577: commons-httpclient - org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient be...
org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field.
Scope: local
bookworm: resolved (fixed in 3.1-11)
bullseye: resolved (fixed in 3.1-11)
forky: resolved (fixed in 3.1-11)
sid: resolved (fixed in 3.1-11)
trixie: resolved (fixed in 3.1-11)
GHSA
Improper Verification of Cryptographic Signature in org.apache.httpcomponents:httpclient
ghsa·2018-10-17
CVE-2014-3577 [MEDIUM] CWE-347 Improper Verification of Cryptographic Signature in org.apache.httpcomponents:httpclient
Improper Verification of Cryptographic Signature in org.apache.httpcomponents:httpclient
org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field.
OSV
Improper Verification of Cryptographic Signature in org.apache.httpcomponents:httpclient
osv·2018-10-17
CVE-2014-3577 [MEDIUM] Improper Verification of Cryptographic Signature in org.apache.httpcomponents:httpclient
Improper Verification of Cryptographic Signature in org.apache.httpcomponents:httpclient
org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field.
OSV
commons-httpclient vulnerabilities
osv·2015-10-14·CVSS 5.8
CVE-2012-5783 [MEDIUM] commons-httpclient vulnerabilities
commons-httpclient vulnerabilities
It was discovered that Apache Commons HttpClient did not properly verify the
Common Name or subjectAltName fields of X.509 certificates. An attacker could
exploit this to perform a machine-in-the-middle attack to view sensitive
information or alter encrypted communications. This issue only affected Ubuntu
12.04 LTS. (CVE-2012-5783)
Florian Weimer discovered the fix for CVE-2012-5783 was incomplete for Apache
Commons HttpClient. An attacker could exploit this to perform a
machine-in-the-middle attack to view sensitive information or alter
encrypted communications. This issue only affected Ubuntu 12.04 LTS.
(CVE-2012-6153)
Subodh Iyengar and Will Shackleton discovered the fix for CVE-2012-5783 was
incomplete for Apache Commons HttpClient. An attacker cou
OSV
CVE-2014-3577: org
osv·2014-08-21·CVSS 5.8
CVE-2014-3577 [MEDIUM] CVE-2014-3577: org
org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2014-3577 jakarta-commons-httpclient: SSL hostname verification bypass, incomplete CVE-2012-6153 fix [fedora-all]
bugzilla·2014-08-18·CVSS 4.3
CVE-2014-3577 [MEDIUM] CVE-2014-3577 jakarta-commons-httpclient: SSL hostname verification bypass, incomplete CVE-2012-6153 fix [fedora-all]
CVE-2014-3577 jakarta-commons-httpclient: SSL hostname verification bypass, incomplete CVE-2012-6153 fix [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue
Bugzilla
CVE-2014-3577 httpcomponents-client: Apache HttpComponents client: Hostname verification susceptible to MITM attack [fedora-all]
bugzilla·2014-08-18·CVSS 5.8
CVE-2014-3577 [MEDIUM] CVE-2014-3577 httpcomponents-client: Apache HttpComponents client: Hostname verification susceptible to MITM attack [fedora-all]
CVE-2014-3577 httpcomponents-client: Apache HttpComponents client: Hostname verification susceptible to MITM attack [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE:
Bugzilla
CVE-2012-6153 Apache HttpComponents client / Apache CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix
bugzilla·2014-08-14·CVSS 5.8
CVE-2012-6153 [MEDIUM] CVE-2012-6153 Apache HttpComponents client / Apache CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix
CVE-2012-6153 Apache HttpComponents client / Apache CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix
It was found that the fix for CVE-2012-5783 was incomplete. The code added to check that the server hostname matches the domain name in the subject's CN field was flawed. This can be exploited by a Man-in-the-middle (MITM) attack, where the attacker can spoof a valid certificate using a specially crafted subject.
Discussion:
Acknowledgements:
This issue was discovered by Florian Weimer of Red Hat Product Security.
---
Upstream Commit:
HttpClient/4.2.x Branch
http://svn.apache.org/viewvc?view=revision&revision=1411705
---
Affects:
org.apache.httpcomponents:httpclient This issue has been addressed in following products:
>
> Red Hat Software Collections 1 for Red H
Bugzilla
CVE-2014-3596 axis: SSL hostname verification bypass, incomplete CVE-2012-5784 fix
bugzilla·2014-08-14·CVSS 5.8
CVE-2014-3596 [MEDIUM] CVE-2014-3596 axis: SSL hostname verification bypass, incomplete CVE-2012-5784 fix
CVE-2014-3596 axis: SSL hostname verification bypass, incomplete CVE-2012-5784 fix
It was found that the fix for CVE-2012-5784 was incomplete. The code added to check that the server hostname matches the domain name in the subject's CN field was flawed. This can be exploited by a Man-in-the-middle (MITM) attack where the attacker can spoof a valid certificate using a specially crafted subject.
Discussion:
Statement:
Note that Axis 1 is EOL upstream, and the incomplete patch for CVE-2012-5784 was never merged upstream. It was, however, shipped by various vendors, including Debian and Red Hat. Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1164433
Acknowledgements:
This issue was discovered by David Jorm and Arun Neelicattu
Bugzilla
CVE-2014-3577 Apache HttpComponents client / Apache CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix
bugzilla·2014-08-12·CVSS 4.3
CVE-2014-3577 [MEDIUM] CVE-2014-3577 Apache HttpComponents client / Apache CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix
CVE-2014-3577 Apache HttpComponents client / Apache CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix
It was found that the fix for CVE-2012-6153 was incomplete. The code added to check that the server hostname matches the domain name in the subject's CN field was flawed. This can be exploited by a Man-in-the-middle (MITM) attack where the attacker can spoof a valid certificate using a specially crafted subject.
Discussion:
Statement:
Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533
This issue affects the versions of HttpComponents Client as shipped with Red Hat JBoss Data Grid 6 and Red Hat JBoss Data Virtualization 6; and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. Howeve
Bugzilla
CVE-2012-5783 jakarta-commons-httpclient: missing connection hostname check against X.509 certificate name
bugzilla·2012-11-05·CVSS 5.8
CVE-2012-5783 [MEDIUM] CVE-2012-5783 jakarta-commons-httpclient: missing connection hostname check against X.509 certificate name
CVE-2012-5783 jakarta-commons-httpclient: missing connection hostname check against X.509 certificate name
Common Vulnerabilities and Exposures assigned an identifier CVE-2012-5783 to the following vulnerability:
Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via andaarbitrary valid certificate.
References:
[1] http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
[2] https://crypto.stanford.edu/~dabo/pubs/abstracts/ssl-client-bugs.html
[3] http://www.sigsac.org/ccs/CCS2012/techprogram.shtml
Discussion:
Created jak
arXiv
Impact assessment for vulnerabilities in open-source software libraries
arxiv_fulltext·2015-04-21
Impact assessment for vulnerabilities in open-source software libraries
fancy
Software applications integrate more and more open-source software
(OSS) to benefit from code reuse. As a drawback, each vulnerability
discovered in bundled OSS potentially affects the application. Upon
the disclosure of every new vulnerability, the application vendor has
to decide whether it is exploitable in his particular usage context,
hence, whether users require an urgent application patch containing a
non-vulnerable version of the OSS. Current decision making is mostly
based on high-level vulnerability descriptions and expert knowledge,
thus, effort intense and error prone. This paper proposes a pragmatic
approach to facilitate the impact assessment, describes a
proof-of-concept for Java, and examines one example vulnerability as
case study. The approach is independent from s
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00032.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-11/msg00033.htmlhttp://packetstormsecurity.com/files/127913/Apache-HttpComponents-Man-In-The-Middle.htmlhttp://rhn.redhat.com/errata/RHSA-2014-1146.htmlhttp://rhn.redhat.com/errata/RHSA-2014-1166.htmlhttp://rhn.redhat.com/errata/RHSA-2014-1833.htmlhttp://rhn.redhat.com/errata/RHSA-2014-1834.htmlhttp://rhn.redhat.com/errata/RHSA-2014-1835.htmlhttp://rhn.redhat.com/errata/RHSA-2014-1836.htmlhttp://rhn.redhat.com/errata/RHSA-2014-1891.htmlhttp://rhn.redhat.com/errata/RHSA-2014-1892.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0125.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0158.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0675.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0720.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0765.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0850.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0851.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1176.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1177.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1888.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1773.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1931.htmlhttp://seclists.org/fulldisclosure/2014/Aug/48http://secunia.com/advisories/60466http://secunia.com/advisories/60589http://secunia.com/advisories/60713http://www.openwall.com/lists/oss-security/2021/10/06/1http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.htmlhttp://www.osvdb.org/110143http://www.securityfocus.com/bid/69258http://www.securitytracker.com/id/1030812http://www.ubuntu.com/usn/USN-2769-1https://access.redhat.com/solutions/1165533https://exchange.xforce.ibmcloud.com/vulnerabilities/95327https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05103564https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05363782https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3Ehttps://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3Ehttps://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3Ehttps://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3Ehttps://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3Ehttps://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3Ehttps://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3Ehttps://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3Ehttps://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3Ehttps://security.netapp.com/advisory/ntap-20231027-0003/http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00032.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-11/msg00033.htmlhttp://packetstormsecurity.com/files/127913/Apache-HttpComponents-Man-In-The-Middle.htmlhttp://rhn.redhat.com/errata/RHSA-2014-1146.htmlhttp://rhn.redhat.com/errata/RHSA-2014-1166.htmlhttp://rhn.redhat.com/errata/RHSA-2014-1833.htmlhttp://rhn.redhat.com/errata/RHSA-2014-1834.htmlhttp://rhn.redhat.com/errata/RHSA-2014-1835.htmlhttp://rhn.redhat.com/errata/RHSA-2014-1836.htmlhttp://rhn.redhat.com/errata/RHSA-2014-1891.htmlhttp://rhn.redhat.com/errata/RHSA-2014-1892.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0125.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0158.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0675.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0720.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0765.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0850.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0851.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1176.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1177.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1888.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1773.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1931.htmlhttp://seclists.org/fulldisclosure/2014/Aug/48http://secunia.com/advisories/60466http://secunia.com/advisories/60589http://secunia.com/advisories/60713http://www.openwall.com/lists/oss-security/2021/10/06/1http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.htmlhttp://www.osvdb.org/110143http://www.securityfocus.com/bid/69258http://www.securitytracker.com/id/1030812http://www.ubuntu.com/usn/USN-2769-1https://access.redhat.com/solutions/1165533https://exchange.xforce.ibmcloud.com/vulnerabilities/95327https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05103564https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05363782https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3Ehttps://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3Ehttps://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3Ehttps://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3Ehttps://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3Ehttps://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3Ehttps://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3Ehttps://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3Ehttps://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3Ehttps://security.netapp.com/advisory/ntap-20231027-0003/
2014-08-21
Published