Description
Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | axis | 1.4-16.1 | — |
| Debian 13 | axis | 1.4-16.1 | — |
| Debian 12 | axis | 1.4-16.1 | — |
| Debian 6.0 | axis | 1.4-12+deb6u1 | DLA-169-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | axis +2 | 1.2.1-7.3.el6_3 | RHSA-2013:0269 |
| RHEL 5 | axis +2 | 1.2.1-2jpp.7.el5_9 | RHSA-2013:0683 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhev Manager 3 | jasperreports-server-pro | 5.5.0-4.el6ev | RHSA-2014:0037 |
| Red Hat Developer Toolset 2 | devtoolset-2-axis | 1.4-23.el6 | RHSA-2014:1123 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | axis | 1.4-5.8.1 | SUSE-SU-2019:1373-2 |
| SLES 15 | axis | 1.4-5.8.1 | SUSE-SU-2019:1373-1 |
| SLES 12 SP4 | axis | 1.4-290.6.1 | SUSE-SU-2019:1382-1 |
| SLES 12 SP3 | axis | 1.4-290.6.1 | SUSE-SU-2019:1382-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP4 | axis | 1.4-290.6.1 | SUSE-SU-2019:1382-1 |
| SLES for SAP 12 SP3 | axis | 1.4-290.6.1 | SUSE-SU-2019:1382-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.0 | axis | 1.4-lp150.9.1 | openSUSE-SU-2019:1497-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | axis:axis | <= 1.4 | — | GHSA-55w9-c3g2-4rrh |
| Maven | org.apache.axis:axis | <= 1.4 | — | GHSA-55w9-c3g2-4rrh |
Advisories 10
- RHSA-2014:1123 Red Hat Security Advisory: devtoolset-2-axis security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2014:0037 Red Hat Security Advisory: jasperreports-server-pro security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2013:0683 Red Hat Security Advisory: axis security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2013:0269 Red Hat Security Advisory: axis security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- DLA-169-1 axis - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2019:1497-1 Security update for axis SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:1373-1 Security update for axis SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:1382-1 Security update for axis SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:1373-2 Security update for axis SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-0273 IBM Maximo Asset Management: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 2, 2023
References
- RHSA-2013:0269 vendor-advisory
- RHSA-2014:0037 vendor-advisory
- 51219 third-party-advisory
- RHSA-2013:0683 vendor-advisory
- 56408 vdb-entry
- apache-axis-ssl-spoofing(79829) vdb-entry
- http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
- [axis-java-dev] 20190503 [jira] [Commented] (AXIS-2905) Insecure certificate validation CVE-2014-3596 mailing-list
- [axis-java-dev] 20190503 [jira] [Comment Edited] (AXIS-2905) Insecure certificate validation CVE-2014-3596 mailing-list
- openSUSE-SU-2019:1497 vendor-advisory
- openSUSE-SU-2019:1526 vendor-advisory
- [axis-java-dev] 20190907 [jira] [Commented] (AXIS-2905) Insecure certificate validation CVE-2014-3596 mailing-list
- [axis-java-dev] 20190909 [jira] [Resolved] (AXIS-2905) Insecure certificate validation CVE-2014-3596 mailing-list
- [axis-java-dev] 20190909 [jira] [Commented] (AXIS-2905) Insecure certificate validation CVE-2014-3596 mailing-list