Skip to content
OpenAdvisories
Unscored DLA-169-1 2 CVEs

axis - security update

Published Mar 10, 2015 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 6.0 axis 1.4-12+deb6u1

Vulnerabilities 2

  • Medium —
    CVE-2012-5784

    Man-in-the-middle attack in Apache Axis

    Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name…

    axis org.apache.axis:axis axis:axis Debian Maven
  • Medium —
    CVE-2014-3596

    Improper Validation of Certificates in apache axis

    The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL…

    axis org.apache.axis:axis axis:axis Debian Maven