Red Hat Security Advisory: Red Hat JBoss Enterprise Web Platform 5.2.0 security update

Fixed packages 10

Vulnerabilities 2

• High —
  CVE-2012-6153

  Improper certificate validation in org.apache.httpcomponents:httpclient

  http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-m…

  org.apache.httpcomponents:httpclient commons-httpclient Debian Maven
  Sep 4, 2014
• Medium —
  CVE-2014-3577

  Improper Verification of Cryptographic Signature in org.apache.httpcomponents:httpclient

  org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of th…

  httpcomponents-client org.apache.httpcomponents:httpclient httpcomponents-client commons-httpclient Debian Ubuntu Maven
  Aug 21, 2014

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/solutions/1165533
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1129074
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1129916
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1320.json
• report
  https://access.redhat.com/security/cve/CVE-2012-6153
• advisory
  https://www.cve.org/CVERecord?id=CVE-2012-6153
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2012-6153
• report
  https://access.redhat.com/security/cve/CVE-2014-3577
• advisory
  https://www.cve.org/CVERecord?id=CVE-2014-3577
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2014-3577