Description
http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5783.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | commons-httpclient | 3.1-10.2 | — |
| Debian 13 | commons-httpclient | 3.1-10.2 | — |
| Debian 12 | commons-httpclient | 3.1-10.2 | — |
| Debian 6.0 | commons-httpclient | 3.1-9+deb6u1 | DLA-222-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | commons-httpclient | 3.1-10.2ubuntu0.14.04.1 | USN-2769-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhev Manager 3 | rhevm +16 | 3.5.0-0.29.el6ev | RHSA-2015:0158 |
| Red Hat JBoss Web Platform 5 | apache-cxf | 2.2.12-14.patch_09.el6 | RHSA-2014:1833 |
| Red Hat JBoss Web Platform 5 | jakarta-commons-httpclient | 1:3.1-4_patch_02.el6_5 | RHSA-2014:1320 |
| Red Hat JBoss Web Platform 5 | jboss-seam2 +3 | 2.2.6.EAP5-22_patch_01.el6 | RHSA-2014:1320 |
| Red Hat JBoss EAP 6 | apache-cxf | 2.7.12-1.SP1_redhat_5.1.ep6.el5 | RHSA-2014:2019 |
| Red Hat JBoss EAP 6 | httpcomponents-eap6 +1 | 6-12.redhat_2.1.ep6.el5 | RHSA-2014:1162 |
| Red Hat JBoss EAP 6 | httpcore-eap6 +4 | 4.2.1-12.redhat_2.1.ep6.el5 | RHSA-2014:1162 |
| Red Hat JBoss EAP 6 | wss4j | 1.6.16-2.redhat_3.1.ep6.el5 | RHSA-2014:2019 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 5 | apache-cxf | 2.2.12-14.patch_09.el6 | RHSA-2014:1834 |
| Red Hat JBoss EAP 5 | jakarta-commons-httpclient | 1:3.1-4_patch_02.el6_5 | RHSA-2014:1321 |
| Red Hat JBoss EAP 5 | jboss-seam2 +3 | 2.2.6.EAP5-22_patch_01.el6 | RHSA-2014:1321 |
| Red Hat Developer Toolset 2 | devtoolset-2-httpcomponents-client +1 | 4.2.1-6.el6 | RHSA-2014:1098 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.httpcomponents:httpclient | < 4.2.3 | 4.2.3 | GHSA-2x83-r56g-cv47 |
Advisories 11
- RHSA-2015:0158 Red Hat Security Advisory: Red Hat Enterprise Virtualization Manager 3.5.0 Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2014:1834 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 5.2.0 security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2014:2019 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.2 security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2014:1833 Red Hat Security Advisory: Red Hat JBoss Enterprise Web Platform 5.2.0 security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2014:1321 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 5.2.0 security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2014:1162 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.0 security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2014:1320 Red Hat Security Advisory: Red Hat JBoss Enterprise Web Platform 5.2.0 security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2014:1098 Red Hat Security Advisory: devtoolset-2-httpcomponents-client security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- DLA-222-1 commons-httpclient - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-2769-1 commons-httpclient vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
References
- RHSA-2014:1891 vendor-advisory
- RHSA-2015:0765 vendor-advisory
- https://access.redhat.com/solutions/1165533
- RHSA-2015:0675 vendor-advisory
- RHSA-2014:1098 vendor-advisory
- RHSA-2015:0720 vendor-advisory
- RHSA-2015:1888 vendor-advisory
- RHSA-2014:1833 vendor-advisory
- RHSA-2015:0850 vendor-advisory
- RHSA-2015:0158 vendor-advisory
- RHSA-2014:1834 vendor-advisory
- http://svn.apache.org/viewvc?view=revision&revision=1411705
- RHSA-2015:0125 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1129916
- RHSA-2014:1892 vendor-advisory
- RHSA-2015:0851 vendor-advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05103564
- RHSA-2014:1835 vendor-advisory
- 69257 vdb-entry
- USN-2769-1 vendor-advisory
- RHSA-2014:1836 vendor-advisory