Unscored DLA-222-1 3 CVEs

commons-httpclient - security update

Published May 16, 2015 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

Release	Package	Fixed in
Debian · 6.0	commons-httpclient	3.1-9+deb6u1

Vulnerabilities 3

Medium —

CVE-2012-5783

Improper Certificate Validation in Apache Commons HttpClient

Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certif…

trino trino-plugin-opensearch trino-plugin-pinot trino-plugin-lakehouse Debian Wolfi Maven

Nov 4, 2012
High —

CVE-2012-6153

Improper certificate validation in org.apache.httpcomponents:httpclient

http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-m…

org.apache.httpcomponents:httpclient commons-httpclient Debian Maven

Sep 4, 2014
Medium —

CVE-2014-3577

Improper Verification of Cryptographic Signature in org.apache.httpcomponents:httpclient

org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of th…

httpcomponents-client org.apache.httpcomponents:httpclient httpcomponents-client commons-httpclient Debian Ubuntu Maven

Aug 21, 2014