org.apache.httpcomponents:httpclient

4 results · Clear filters · Feed

• Medium 5.3
  CVE-2020-13956

  Cross-site scripting in Apache HttpClient

  Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.

  httpcomponents-client httpcomponents-client org.apache.httpcomponents:httpclient Debian Ubuntu Maven
  Dec 2, 2020
• Medium —
  CVE-2015-5262 EPSS 19%

  Denial of service vulnerability in org.apache.httpcomponents:httpclient

  http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unsp…

  org.apache.httpcomponents:httpclient httpcomponents-client httpcomponents-client commons-httpclient Debian Ubuntu Maven
  Oct 27, 2015
• Medium —
  CVE-2014-3577

  Improper Verification of Cryptographic Signature in org.apache.httpcomponents:httpclient

  org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of th…

  httpcomponents-client org.apache.httpcomponents:httpclient httpcomponents-client commons-httpclient Debian Ubuntu Maven
  Aug 21, 2014
• Medium —
  CVE-2011-1498

  Exposure of Sensitive Information to an Unauthorized Actor in Apache HttpClient

  Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Authorization header to the origin server, which allows remote web servers to obtain sensitive information by logging this header.

  org.apache.httpcomponents:httpclient httpcomponents-client Debian Maven
  Jul 7, 2011