Description
The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | axis | 1.4-21 | — |
| Debian 13 | axis | 1.4-21 | — |
| Debian 12 | axis | 1.4-21 | — |
| Debian 6.0 | axis | 1.4-12+deb6u1 | DLA-169-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | axis +2 | 1.2.1-7.5.el6_5 | RHSA-2014:1193 |
| RHEL 5 | axis +2 | 1.2.1-2jpp.8.el5_10 | RHSA-2014:1193 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | axis | 1.4-5.8.1 | SUSE-SU-2019:1373-2 |
| SLES 15 | axis | 1.4-5.8.1 | SUSE-SU-2019:1373-1 |
| SLES 12 SP4 | axis | 1.4-290.6.1 | SUSE-SU-2019:1382-1 |
| SLES 12 SP3 | axis | 1.4-290.6.1 | SUSE-SU-2019:1382-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP4 | axis | 1.4-290.6.1 | SUSE-SU-2019:1382-1 |
| SLES for SAP 12 SP3 | axis | 1.4-290.6.1 | SUSE-SU-2019:1382-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.0 | axis | 1.4-lp150.9.1 | openSUSE-SU-2019:1497-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | axis:axis | <= 1.4 | — | GHSA-r53v-vm87-f72c |
| Maven | org.apache.axis:axis | <= 1.4 | — | GHSA-r53v-vm87-f72c |
Advisories 7
- RHSA-2014:1193 Red Hat Security Advisory: axis security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- DLA-169-1 axis - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2019:1497-1 Security update for axis SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:1373-1 Security update for axis SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:1382-1 Security update for axis SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:1373-2 Security update for axis SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-0273 IBM Maximo Asset Management: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 2, 2023
References
- [oss-security] 20140820 CVE-2014-3596 - Apache Axis 1 vulnerable to MITM attack mailing-list
- https://issues.apache.org/jira/browse/AXIS-2905
- apache-axis-cve20143596-spoofing(95377) vdb-entry
- 1030745 vdb-entry
- 61222 third-party-advisory
- RHSA-2014:1193 vendor-advisory
- 69295 vdb-entry
- http://linux.oracle.com/errata/ELSA-2014-1193.html
- [axis-java-dev] 20190503 [jira] [Commented] (AXIS-2905) Insecure certificate validation CVE-2014-3596 mailing-list
- [axis-java-dev] 20190503 [jira] [Comment Edited] (AXIS-2905) Insecure certificate validation CVE-2014-3596 mailing-list
- openSUSE-SU-2019:1497 vendor-advisory
- openSUSE-SU-2019:1526 vendor-advisory
- [axis-java-dev] 20190907 [jira] [Commented] (AXIS-2905) Insecure certificate validation CVE-2014-3596 mailing-list
- [axis-java-dev] 20190909 [jira] [Resolved] (AXIS-2905) Insecure certificate validation CVE-2014-3596 mailing-list
- [axis-java-dev] 20190909 [jira] [Commented] (AXIS-2905) Insecure certificate validation CVE-2014-3596 mailing-list
- https://www.oracle.com/security-alerts/cpujan2020.html