Description
Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, which allows man-in-the-middle attackers to spoof HTTPS servers by presenting an arbitrary certificate during use of a typical AHC configuration, as demonstrated by a configuration that does not send client certificates.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 12 | async-http-client | 1.6.5-3 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 14.04 LTS | async-http-client | 1.6.5-2ubuntu0.1~esm1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.ning:async-http-client | < 1.9.0 | 1.9.0 | GHSA-8h53-fjgg-g42g |
References
- RHSA-2015:0850 vendor-advisory
- RHSA-2015:1176 vendor-advisory
- RHSA-2015:0851 vendor-advisory
- 69316 vdb-entry
- https://github.com/AsyncHttpClient/async-http-client/issues/352
- https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-06-20
- [oss-security] 20140825 Re: CVE Request: Multiple issues in com.ning:async-http-client mailing-list
- RHSA-2015:1551 vendor-advisory
- [pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1 mailing-list
- [pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list mailing-list