{"id":"CVE-2012-6153","published":"2014-09-04T17:00:00Z","modified":"2024-08-06T21:28:39Z","title":"http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server…","vendor":null,"product":null,"tier":"tail","description":{"text":"http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field.  NOTE: this issue exists because of an incomplete fix for CVE-2012-5783.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.05844,"percentile":0.93147,"provenance":"source"},"cwes":[],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2014-1891.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0765.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/solutions/1165533","tags":["x_refsource_CONFIRM"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0675.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1098.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0720.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1888.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1833.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0850.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0158.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1834.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://svn.apache.org/viewvc?view=revision&revision=1411705","tags":["x_refsource_CONFIRM"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0125.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1129916","tags":["x_refsource_CONFIRM"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1892.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0851.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05103564","tags":["x_refsource_CONFIRM"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1835.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.securityfocus.com/bid/69257","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://www.ubuntu.com/usn/USN-2769-1","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1836.html","tags":["vendor-advisory","x_refsource_REDHAT"]}],"priority":{"score":18.6,"factors":[{"name":"EPSS percentile","points":18.63}]},"affected":[{"ecosystem":"Maven","package":"org.apache.httpcomponents:httpclient","vulnerableRanges":["<4.2.3"],"patched":["4.2.3"],"from":["GHSA-2x83-r56g-cv47"],"provenance":"source"}],"euvd":{"id":"EUVD-2018-0479","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-org-apache-httpcomponents-httpclient-cve-2012-5783","parents":[{"from":"CVE-2012-5783","to":"CVE-2012-6153","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this issue exists because of an incomplete fix for CVE-2012-5783.","from":"CVE.org","in":"CVE-2012-6153"}]},{"from":"CVE-2014-3577","to":"CVE-2012-6153","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["httpclient/src/main/java/org/apache/http/conn/ssl/AbstractVerifier.java"],"commits":["https://github.com/apache/httpcomponents-client/commit/6e14fc146a66e0f3eb362f45f95d1a58ee18886a","https://github.com/apache/httpcomponents-client/commit/b930227f907af1198765fc47beabbddae344ca7b","https://github.com/apache/httpcomponents-client/commit/51cc67567765d67f878f0dcef61b5ded454d3122"],"basis":"rarely changed file"},{"kind":"similar","provenance":"machine","score":0.66,"basis":"same package + description similarity"}]}]}}