Description
org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | commons-httpclient | 3.1-11 | — |
| Debian 14 | httpcomponents-client | 4.3.5-1 | — |
| Debian 13 | commons-httpclient | 3.1-11 | — |
| Debian 13 | httpcomponents-client | 4.3.5-1 | — |
| Debian 12 | commons-httpclient | 3.1-11 | — |
| Debian 12 | httpcomponents-client | 4.3.5-1 | — |
| Debian 6.0 | commons-httpclient | 3.1-9+deb6u1 | DLA-222-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | commons-httpclient | 3.1-10.2ubuntu0.14.04.1 | USN-2769-1 |
| Ubuntu 14.04 LTS | httpcomponents-client | 4.3.3-1ubuntu0.1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | httpcomponents-client +1 | 4.2.5-5.el7_0 | RHSA-2014:1146 |
| RHEL 7 | jakarta-commons-httpclient +3 | 1:3.1-16.el7_0 | RHSA-2014:1166 |
| RHEL 6 | jakarta-commons-httpclient +3 | 1:3.1-0.9.el6_5 | RHSA-2014:1166 |
| RHEL 5 | jakarta-commons-httpclient +3 | 1:3.0-7jpp.4.el5_10 | RHSA-2014:1166 |
| RHEL 1 | thermostat1-httpcomponents-client +1 | 4.2.5-3.4.el6.1 | RHSA-2014:1082 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhev Manager 3 | rhevm +16 | 3.5.0-0.29.el6ev | RHSA-2015:0158 |
| Red Hat OpenShift 4 | coreos-installer +1 | 0.12.0-1.rhaos4.10.el8 | RHSA-2022:0055 |
| Red Hat OpenShift 4 | cri-o | 1.23.0-92.rhaos4.10.gitdaab4d1.el7 | RHSA-2022:0055 |
| Red Hat OpenShift 4 | jenkins | 2.319.2.1643288987-1.el8 | RHSA-2022:0055 |
| Red Hat OpenShift 4 | jenkins-2-plugins | 4.10.1643404185-1.el8 | RHSA-2022:0055 |
| Red Hat OpenShift 4 | openshift +1 | 4.10.0-202202250816.p0.ge419edf.assembly.stream.el7 | RHSA-2022:0055 |
| Red Hat OpenShift 4 | openshift-clients +1 | 4.10.0-202202160023.p0.gf93da17.assembly.stream.el7 | RHSA-2022:0055 |
| Red Hat OpenShift 2 | ImageMagick +3 | 6.7.2.7-5.el6_8 | RHSA-2016:1773 |
| Red Hat OpenShift 2 | activemq +1 | 5.9.0-6.redhat.611463.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | jenkins | 1.651.2-1.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | libcgroup +1 | 0.40.rc1-18.el6_8 | RHSA-2016:1773 |
| Red Hat OpenShift 2 | openshift-origin-broker | 1.16.3.2-1.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | openshift-origin-broker-util | 1.37.6.2-1.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-cron | 1.25.4.2-1.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-diy +1 | 1.26.2.2-1.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-haproxy | 1.31.6.2-1.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-jbosseap | 2.27.4.2-1.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-jbossews | 1.35.5.2-1.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-jenkins | 1.29.2.2-1.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-jenkins-client | 1.26.1.1-1.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-mysql | 1.31.3.3-1.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-nodejs | 1.33.1.2-1.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-perl +1 | 1.30.2.2-1.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-php | 1.35.4.2-1.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-python | 1.34.3.2-1.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-ruby | 1.32.2.2-1.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | openshift-origin-node-proxy | 1.26.3.1-1.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | rhc +1 | 1.38.7.1-1.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | rubygem-openshift-origin-admin-console | 1.28.2.1-1.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | rubygem-openshift-origin-frontend-haproxy-sni-proxy | 0.5.2.1-1.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | rubygem-openshift-origin-msg-broker-mcollective | 1.36.2.4-1.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | rubygem-openshift-origin-node +1 | 1.38.6.4-1.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | rubygem-openshift-origin-routing-daemon | 0.26.6.1-1.el6op | RHSA-2016:1773 |
| Red Hat JBoss Web Platform 5 | apache-cxf | 2.2.12-14.patch_09.el6 | RHSA-2014:1833 |
| Red Hat JBoss Web Platform 5 | jakarta-commons-httpclient | 1:3.1-4_patch_02.el6_5 | RHSA-2014:1320 |
| Red Hat JBoss Web Platform 5 | jboss-seam2 +3 | 2.2.6.EAP5-22_patch_01.el6 | RHSA-2014:1320 |
| Red Hat JBoss EAP 6 | apache-cxf | 2.7.12-1.SP1_redhat_5.1.ep6.el5 | RHSA-2014:2019 |
| Red Hat JBoss EAP 6 | httpcomponents-eap6 +1 | 6-12.redhat_2.1.ep6.el5 | RHSA-2014:1162 |
| Red Hat JBoss EAP 6 | httpcore-eap6 +4 | 4.2.1-12.redhat_2.1.ep6.el5 | RHSA-2014:1162 |
| Red Hat JBoss EAP 6 | wss4j | 1.6.16-2.redhat_3.1.ep6.el5 | RHSA-2014:2019 |
| Red Hat JBoss EAP 5 | apache-cxf | 2.2.12-14.patch_09.el6 | RHSA-2014:1834 |
| Red Hat JBoss EAP 5 | jakarta-commons-httpclient | 1:3.1-4_patch_02.el6_5 | RHSA-2014:1321 |
| Red Hat JBoss EAP 5 | jboss-seam2 +3 | 2.2.6.EAP5-22_patch_01.el6 | RHSA-2014:1321 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP2 | apache-commons-httpclient | 3.1-11.3.2 | SUSE-SU-2020:3152-1 |
| SLES 15 SP1 | apache-commons-httpclient | 3.1-4.3.2 | SUSE-SU-2020:3151-1 |
| SLES 15 | apache-commons-httpclient | 3.1-4.3.2 | SUSE-SU-2020:3151-1 |
| SLES 12 SP5 | apache-commons-httpclient | 3.1-6.3.1 | SUSE-SU-2020:3149-1 |
| SLES 12 SP4 | apache-commons-httpclient | 3.1-6.3.1 | SUSE-SU-2020:3149-1 |
Show 15 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP3 | apache-commons-httpclient | 3.1-6.3.1 | SUSE-SU-2020:3149-1 |
| SLES 12 SP2 | apache-commons-httpclient | 3.1-6.3.1 | SUSE-SU-2020:3149-1 |
| SLES for SAP 15 | apache-commons-httpclient | 3.1-4.3.2 | SUSE-SU-2020:3151-1 |
| SLES for SAP 12 SP5 | apache-commons-httpclient | 3.1-6.3.1 | SUSE-SU-2020:3149-1 |
| SLES for SAP 12 SP4 | apache-commons-httpclient | 3.1-6.3.1 | SUSE-SU-2020:3149-1 |
| SLES for SAP 12 SP3 | apache-commons-httpclient | 3.1-6.3.1 | SUSE-SU-2020:3149-1 |
| SLES for SAP 12 SP2 | apache-commons-httpclient | 3.1-6.3.1 | SUSE-SU-2020:3149-1 |
| SLE HPC 15 | apache-commons-httpclient | 3.1-4.3.2 | SUSE-SU-2020:3151-1 |
| SUSE OpenStack Cloud Crowbar 9 | apache-commons-httpclient | 3.1-6.3.1 | SUSE-SU-2020:3149-1 |
| SUSE OpenStack Cloud Crowbar 8 | apache-commons-httpclient | 3.1-6.3.1 | SUSE-SU-2020:3149-1 |
| SUSE OpenStack Cloud 9 | apache-commons-httpclient | 3.1-6.3.1 | SUSE-SU-2020:3149-1 |
| SUSE OpenStack Cloud 8 | apache-commons-httpclient | 3.1-6.3.1 | SUSE-SU-2020:3149-1 |
| SUSE OpenStack Cloud 7 | apache-commons-httpclient | 3.1-6.3.1 | SUSE-SU-2020:3149-1 |
| SUSE HPE Helion OpenStack 8 | apache-commons-httpclient | 3.1-6.3.1 | SUSE-SU-2020:3149-1 |
| SUSE Enterprise Storage 5 | apache-commons-httpclient | 3.1-6.3.1 | SUSE-SU-2020:3149-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apache-commons-httpclient | 3.1-13.4 | openSUSE-SU-2024:10621-1 |
| openSUSE Leap 15.2 | apache-commons-httpclient | 3.1-lp152.6.3.1 | openSUSE-SU-2020:1875-1 |
| openSUSE Leap 15.1 | apache-commons-httpclient | 3.1-lp151.4.3.1 | openSUSE-SU-2020:1873-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | httpcomponents-client +1 | 4.2.5-5.el7_0 | ELSA-2014-1146 |
| Oracle Linux 7 | jakarta-commons-httpclient +3 | 1:3.1-16.el7_0 | ELSA-2014-1166 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.httpcomponents:httpclient | < 4.3.5 | 4.3.5 | GHSA-cfh5-3ghh-wfjx |
Advisories 27
- WID-SEC-2026-0351 Dell NetWorker (Third Party Components): Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 31, 2026
- RHSA-2022:0055 Red Hat Security Advisory: OpenShift Container Platform 4.10.3 bug fix and security update Red Hat Security Advisories (RHSA) · Aug 20, 2026
- RHSA-2015:0158 Red Hat Security Advisory: Red Hat Enterprise Virtualization Manager 3.5.0 Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2014:2019 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.2 security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2014:1834 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 5.2.0 security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2014:1321 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 5.2.0 security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2014:1833 Red Hat Security Advisory: Red Hat JBoss Enterprise Web Platform 5.2.0 security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2014:1162 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.0 security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2014:1320 Red Hat Security Advisory: Red Hat JBoss Enterprise Web Platform 5.2.0 security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2016:1773 Red Hat Security Advisory: Red Hat OpenShift Enterprise 2.2.10 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2014:1166 Red Hat Security Advisory: jakarta-commons-httpclient security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2014:1146 Red Hat Security Advisory: httpcomponents-client security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2014:1082 Red Hat Security Advisory: thermostat1-httpcomponents-client security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- WID-SEC-2023-0306 Apache HttpComponents: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Aug 2, 2026
- DLA-222-1 commons-httpclient - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-2769-1 commons-httpclient vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- SUSE-SU-2020:3151-1 Security update for apache-commons-httpclient SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:1875-1 Security update for apache-commons-httpclient SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10621-1 apache-commons-httpclient-3.1-13.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:1873-1 Security update for apache-commons-httpclient SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:3152-1 Security update for apache-commons-httpclient SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2022-1375 JFrog Artifactory: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 12, 2025
- WID-SEC-2025-1459 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 3, 2025
- SUSE-SU-2020:3149-1 Security update for apache-commons-httpclient SUSE / openSUSE Security Updates · May 2, 2025
- WID-SEC-2023-0432 Jenkins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 20, 2023
- ELSA-2014-1166 Important: jakarta-commons-httpclient security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Sep 8, 2014
- ELSA-2014-1146 Important: httpcomponents-client security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Sep 3, 2014
References
- RHSA-2014:1891 vendor-advisory
- RHSA-2015:0765 vendor-advisory
- https://access.redhat.com/solutions/1165533
- 110143 vdb-entry
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- RHSA-2015:0675 vendor-advisory
- 60713 third-party-advisory
- http://packetstormsecurity.com/files/127913/Apache-HttpComponents-Man-In-The-Middle.html
- RHSA-2015:0720 vendor-advisory
- RHSA-2014:1166 vendor-advisory
- RHSA-2015:1888 vendor-advisory
- RHSA-2014:1833 vendor-advisory
- RHSA-2015:0850 vendor-advisory
- RHSA-2015:0158 vendor-advisory
- RHSA-2014:1834 vendor-advisory
- 60466 third-party-advisory
- RHSA-2015:0125 vendor-advisory
- RHSA-2015:1176 vendor-advisory
- RHSA-2016:1931 vendor-advisory
- RHSA-2014:1146 vendor-advisory
- RHSA-2015:1177 vendor-advisory
- 69258 vdb-entry
- RHSA-2014:1892 vendor-advisory
- RHSA-2015:0851 vendor-advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05103564
- RHSA-2014:1835 vendor-advisory
- 1030812 vdb-entry
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05363782
- USN-2769-1 vendor-advisory
- 60589 third-party-advisory
- RHSA-2014:1836 vendor-advisory
- apache-cve20143577-spoofing(95327) vdb-entry
- 20140818 CVE-2014-3577: Apache HttpComponents client: Hostname verification susceptible to MITM attack mailing-list
- RHSA-2016:1773 vendor-advisory
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities mailing-list
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- [cxf-commits] 20200116 svn commit: r1055336 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-12423.txt.asc security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html mailing-list
- [cxf-commits] 20200319 svn commit: r1058035 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html mailing-list
- [cxf-commits] 20200401 svn commit: r1058573 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2020-1954.txt.asc security-advisories.html mailing-list
- openSUSE-SU-2020:1873 vendor-advisory
- openSUSE-SU-2020:1875 vendor-advisory
- [cxf-commits] 20201112 svn commit: r1067927 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2020-13954.txt.asc security-advisories.html mailing-list
- [cxf-commits] 20210402 svn commit: r1073270 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2021-22696.txt.asc security-advisories.html mailing-list
- [cxf-commits] 20210616 svn commit: r1075801 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2021-30468.txt.asc security-advisories.html mailing-list
- [oss-security] 20211006 Multiple vulnerabilities in Jenkins and Jenkins plugins mailing-list
- https://security.netapp.com/advisory/ntap-20231027-0003/