High ELSA-2014-1146 1 CVE

Important: httpcomponents-client security update (Oracle Linux 7)

Published Sep 3, 2014 · Updated Sep 3, 2014

Ecosystem: Oracle Linux

Summary

[4.2.5-5]
- Fix MITM security vulnerability
- Resolves: CVE-2014-3577

Fixed packages 2

Release	Package	Fixed in
Oracle Linux · 7	httpcomponents-client	0:4.2.5-5.el7_0
Oracle Linux · 7	httpcomponents-client-javadoc	0:4.2.5-5.el7_0

Vulnerabilities 1

Medium —

CVE-2014-3577

Improper Verification of Cryptographic Signature in org.apache.httpcomponents:httpclient

org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of th…

httpcomponents-client org.apache.httpcomponents:httpclient httpcomponents-client commons-httpclient Debian Ubuntu Maven

Aug 21, 2014