CVE-2014-3577

CWE-347CWE-29712 documents9 sources
Severity
5.8MEDIUM
EPSS
1.4%
top 19.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache HttpasyncclientApache Httpclient
Timeline
PublishedAug 21
Latest updateOct 6

Description

org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field.

CVSS vector

AV:N/AC:M/C:P/I:P/A:NExploitability: 8.6 | Impact: 4.9

Affected Packages5 packages

▶NVDapache/httpclient4.0 — 4.3.4
▶NVDapache/httpasyncclient4.0 — 4.0.1
▶Debiancommons-httpclient< 3.1-11+3
▶Debianhttpcomponents-client< 4.3.5-1+3

🔴Vulnerability Details

4
GHSA
Improper Verification of Cryptographic Signature in org.apache.httpcomponents:httpclient↗2018-10-17
▶
OSV
Improper Verification of Cryptographic Signature in org.apache.httpcomponents:httpclient↗2018-10-17
▶
CVEList
CVE-2014-3577: org↗2014-08-21
▶
OSV
CVE-2014-3577: org↗2014-08-21
▶

📋Vendor Advisories

4
Jenkins
Jenkins Security Advisory 2021-10-06↗2021-10-06
▶
Ubuntu
Apache Commons HttpClient vulnerabilities↗2015-10-14
▶
Red Hat
CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix↗2014-08-18
▶
Debian
CVE-2014-3577: commons-httpclient - org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient be...↗2014
▶

💬Community

3
Bugzilla
CVE-2014-3577 jakarta-commons-httpclient: SSL hostname verification bypass, incomplete CVE-2012-6153 fix [fedora-all]↗2014-08-18
▶
Bugzilla
CVE-2014-3577 httpcomponents-client: Apache HttpComponents client: Hostname verification susceptible to MITM attack [fedora-all]↗2014-08-18
▶
Bugzilla
CVE-2014-3577 Apache HttpComponents client / Apache CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix↗2014-08-12
▶
CVE-2014-3577 (MEDIUM CVSS 5.8) | org.apache.http.conn.ssl.AbstractVe | cvebase.io