Skip to content
OpenAdvisories

Package · Maven

com.ning:async-http-client

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium —
    CVE-2013-7397

    Insufficient Verification of Data Authenticity in Async Http Client

    Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, which allows man-in-the-middle attackers to spoof HTTPS servers by presenting an a…

    async-http-client async-http-client com.ning:async-http-client Debian Ubuntu Maven
  • Medium —
    CVE-2013-7398

    Insufficient Verification of Data Authenticity in Async Http Client

    main/java/com/ning/http/client/AsyncHttpClientConfig.java in Async Http Client (aka AHC or async-http-client) before 1.9.0 does not require a hostname match during verification of X.509 certificates, which allows man-in-the-middle attackers to spoof HTTPS ser…

    com.ning:async-http-client Maven