Vulnerability-Lookup

BDU:2024-08705

Vulnerability from fstec - Published: 18.08.2014

Title

Уязвимость клиентского модуля Apache HttpClient средства Apache HttpComponents, позволяющая нарушителю подменить SSL-серверы

Description

Уязвимость клиентского модуля Apache HttpClient средства Apache HttpComponents связана с неправильным подтверждением подлинности сертификата SSL/TLS. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, подменить SSL-серверы путем изменения содержимого в поле distincted name (DN)

Severity


                    
                      AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Vendor

Red Hat Inc., Canonical Ltd., Novell Inc., Сообщество свободного программного обеспечения, IBM Corp., Apache Software Foundation

Software Name

Red Hat Enterprise Virtualization, Red Hat Enterprise Linux, Ubuntu, SUSE Linux Enterprise Server for SAP Applications, SUSE OpenStack Cloud, Red Hat Virtualization, SUSE Linux Enterprise Module for Basesystem, SUSE Enterprise Storage, SUSE Linux Enterprise Point of Sale, Suse Linux Enterprise Server, OpenSUSE Leap, SUSE OpenStack Cloud Crowbar, Red Hat Satellite, Jboss Operations Network, Red Hat Software Collections, SUSE Linux Enterprise High Performance Computing, openSUSE Tumbleweed, Red Hat Storage, Red Hat JBoss Data Virtualization, SUSE Manager Proxy, SUSE Manager Retail Branch Server, SUSE Manager Server, Debian GNU/Linux, Red Hat JBoss Fuse Service Works, Red Hat JBoss SOA Platform, Red Hat OpenShift Enterprise, Suse Linux Enterprise Desktop, Red Hat JBoss Data Grid, Red Hat OpenShift Container Platform, Red Hat JBoss Fuse, Red Hat JBoss Enterprise Application Platform, SUSE Liberty Linux, IBM Storwize V5000, Red Hat Jboss Enterprise Web Platform, Red Hat JBoss BPMS, Jboss Portal, Red Hat JBoss Web Framework Kit, Red Hat JBoss Web Platform, RHEV Manager, Red Hat JBoss Enterprise Web Server, HttpClient, HttpAsyncClient, Red Hat JBoss A-MQ

Software Version

3 (Red Hat Enterprise Virtualization), 5 (Red Hat Enterprise Linux), 6 (Red Hat Enterprise Linux), 7 (Red Hat Enterprise Linux), 12.04 (Ubuntu), 15.04 (Ubuntu), 12 SP2 (SUSE Linux Enterprise Server for SAP Applications), 12 SP3 (SUSE Linux Enterprise Server for SAP Applications), 12 SP4 (SUSE Linux Enterprise Server for SAP Applications), 7 (SUSE OpenStack Cloud), 4 (Red Hat Virtualization), 15 SP1 (SUSE Linux Enterprise Module for Basesystem), 5 (SUSE Enterprise Storage), 12 SP2-CLIENT (SUSE Linux Enterprise Point of Sale), 12 SP2-ESPOS (Suse Linux Enterprise Server), 15.1 (OpenSUSE Leap), 15 (SUSE Linux Enterprise Server for SAP Applications), 15 SP1 (SUSE Linux Enterprise Server for SAP Applications), 12 SP2-LTSS (Suse Linux Enterprise Server), 12 SP3-LTSS (Suse Linux Enterprise Server), 14.04 ESM (Ubuntu), 8 (SUSE OpenStack Cloud), 12 SP3-BCL (Suse Linux Enterprise Server), 12 SP5 (Suse Linux Enterprise Server), 12 SP5 (SUSE Linux Enterprise Server for SAP Applications), 8 (SUSE OpenStack Cloud Crowbar), 5.0 (Red Hat Satellite), 6.0 (Red Hat Satellite), 3.3 (Jboss Operations Network), 6 (SUSE Enterprise Storage), - (Red Hat Software Collections), 12 SP3-ESPOS (Suse Linux Enterprise Server), 9 (SUSE OpenStack Cloud), 9 (SUSE OpenStack Cloud Crowbar), 15-ESPOS (SUSE Linux Enterprise High Performance Computing), 15-LTSS (SUSE Linux Enterprise High Performance Computing), 15-LTSS (Suse Linux Enterprise Server), - (openSUSE Tumbleweed), 3 (Red Hat Storage), 15 SP2 (SUSE Linux Enterprise Module for Basesystem), 6 (Red Hat JBoss Data Virtualization), 3.0 (Jboss Operations Network), 15.2 (OpenSUSE Leap), 12 SP4-ESPOS (Suse Linux Enterprise Server), 12 SP4-LTSS (Suse Linux Enterprise Server), 4.0 (SUSE Manager Proxy), 4.0 (SUSE Manager Retail Branch Server), 4.0 (SUSE Manager Server), 15 SP3 (SUSE Linux Enterprise Module for Basesystem), 15 SP1 (Suse Linux Enterprise Server), 11 (Debian GNU/Linux), 12 (Debian GNU/Linux), 6 (Red Hat JBoss Fuse Service Works), 5 (Red Hat JBoss SOA Platform), 2 (Red Hat OpenShift Enterprise), 15 SP3 (SUSE Linux Enterprise High Performance Computing), 15 SP3 (Suse Linux Enterprise Server), 15 SP3 (SUSE Linux Enterprise Server for SAP Applications), 4.2 (SUSE Manager Proxy), 4.2 (SUSE Manager Server), 15 SP3 (Suse Linux Enterprise Desktop), 7 (SUSE Enterprise Storage), 15 SP2 (Suse Linux Enterprise Server), 15 SP2 (SUSE Linux Enterprise Server for SAP Applications), 4.1 (SUSE Manager Server), 4.1 (SUSE Manager Proxy), 4.1 (SUSE Manager Retail Branch Server), 15 SP4 (Suse Linux Enterprise Server), 15 SP2 (Suse Linux Enterprise Desktop), 15 SP2 (SUSE Linux Enterprise High Performance Computing), 15 SP4 (Suse Linux Enterprise Desktop), 15 SP4 (SUSE Linux Enterprise Server for SAP Applications), 4.2 (SUSE Manager Retail Branch Server), 6 (Red Hat JBoss Data Grid), 4.3 (SUSE Manager Retail Branch Server), 4.3 (SUSE Manager Proxy), 4.3 (SUSE Manager Server), 15 SP4 (SUSE Linux Enterprise High Performance Computing), 4.10 (Red Hat OpenShift Container Platform), 15 SP1 (Suse Linux Enterprise Desktop), 6.2 (Red Hat JBoss Fuse), 7.1 (SUSE Enterprise Storage), 15 SP4 (SUSE Linux Enterprise Module for Basesystem), 15 SP1 (SUSE Linux Enterprise High Performance Computing), 15 SP5 (SUSE Linux Enterprise Server for SAP Applications), 15 SP5 (Suse Linux Enterprise Server), 15 SP5 (Suse Linux Enterprise Desktop), 15 SP5 (SUSE Linux Enterprise High Performance Computing), 15 SP5 (SUSE Linux Enterprise Module for Basesystem), 6 (Red Hat JBoss Enterprise Application Platform), 5 (Red Hat JBoss Enterprise Application Platform), 7 (SUSE Liberty Linux), 15 SP6 (Suse Linux Enterprise Desktop), 15 SP6 (Suse Linux Enterprise Server), 15 SP6 (SUSE Linux Enterprise Server for SAP Applications), 15 SP6 (SUSE Linux Enterprise High Performance Computing), 15 SP6 (SUSE Linux Enterprise Module for Basesystem), 7.8.1.10 (IBM Storwize V5000), 5 for RHEL 5 (Red Hat Jboss Enterprise Web Platform), 5 for RHEL 6 (Red Hat Jboss Enterprise Web Platform), 6 (Red Hat JBoss BPMS), 6.1 (Red Hat JBoss Data Virtualization), 6.2 (Jboss Portal), 5.3 (Red Hat JBoss SOA Platform), 2.7 (Red Hat JBoss Web Framework Kit), 5.2 (Red Hat JBoss Web Platform), 3.5 (RHEV Manager), 4 (Red Hat JBoss Enterprise Application Platform), 1 (Red Hat JBoss Enterprise Web Server), 5 (Jboss Portal), 6 (Jboss Portal), от 4.0.0 до 4.3.4 включительно (HttpClient), от 4.0.0 до 4.0.1 включительно (HttpAsyncClient), 7 LTSS (SUSE Liberty Linux), 1 (Red Hat OpenShift Enterprise), 6.2 (Red Hat JBoss A-MQ), 5 (Red Hat JBoss BPMS), 5 for RHEL 4 (Red Hat JBoss Enterprise Application Platform), 5 for RHEL 5 (Red Hat JBoss Enterprise Application Platform), 5 for RHEL 6 (Red Hat JBoss Enterprise Application Platform), 5.2 (Red Hat JBoss Enterprise Application Platform), 6.3 (Red Hat JBoss Enterprise Application Platform), 6.3 for RHEL 5 (Red Hat JBoss Enterprise Application Platform), 6.3 for RHEL 6 (Red Hat JBoss Enterprise Application Platform), 6.3 for RHEL 7 (Red Hat JBoss Enterprise Application Platform), 4.3 (Red Hat JBoss SOA Platform), 2.2 (Red Hat OpenShift Enterprise), 1 for Red Hat Enterprise Linux 6 (Red Hat Software Collections), 1 for Red Hat Enterprise Linux 6.4 EUS (Red Hat Software Collections), 2.1 (Red Hat Storage)

Possible Mitigations

Использование рекомендаций: Для программных продуктов Apache Software Foundation: https://issues.apache.org/jira/browse/DRILL-7416 Для Debian GNU/Linux: https://security-tracker.debian.org/tracker/CVE-2014-3577 Для программных продуктов Red Hat Inc.: https://access.redhat.com/security/cve/CVE-2014-3577 Для Ubuntu: https://ubuntu.com/security/notices/USN-2769-1 Для программных продуктов Novell Inc.: https://www.suse.com/security/cve/CVE-2014-3577.html Для IBM Storwize V5000: Компенсирующие меры: - минимизация пользовательских привилегий; - отключение/удаление неиспользуемых учётных записей пользователей; - ограничение доступа из общедоступных сетей (Интернет); - использование виртуальных частных сетей для организации удаленного доступа (VPN).

Reference

https://issues.apache.org/jira/browse/DRILL-7416 https://seclists.org/fulldisclosure/2014/Aug/48 https://security-tracker.debian.org/tracker/CVE-2014-3577 https://access.redhat.com/security/cve/CVE-2014-3577 https://ubuntu.com/security/notices/USN-2769-1 https://www.suse.com/security/cve/CVE-2014-3577.html

CWE

CWE-297

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
  "CVSS 3.0": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Red Hat Inc., Canonical Ltd., Novell Inc., \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f, IBM Corp., Apache Software Foundation",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "3 (Red Hat Enterprise Virtualization), 5 (Red Hat Enterprise Linux), 6 (Red Hat Enterprise Linux), 7 (Red Hat Enterprise Linux), 12.04 (Ubuntu), 15.04 (Ubuntu), 12 SP2 (SUSE Linux Enterprise Server for SAP Applications), 12 SP3 (SUSE Linux Enterprise Server for SAP Applications), 12 SP4 (SUSE Linux Enterprise Server for SAP Applications), 7 (SUSE OpenStack Cloud), 4 (Red Hat Virtualization), 15 SP1 (SUSE Linux Enterprise Module for Basesystem), 5 (SUSE Enterprise Storage), 12 SP2-CLIENT (SUSE Linux Enterprise Point of Sale), 12 SP2-ESPOS (Suse Linux Enterprise Server), 15.1 (OpenSUSE Leap), 15 (SUSE Linux Enterprise Server for SAP Applications), 15 SP1 (SUSE Linux Enterprise Server for SAP Applications), 12 SP2-LTSS (Suse Linux Enterprise Server), 12 SP3-LTSS (Suse Linux Enterprise Server), 14.04 ESM (Ubuntu), 8 (SUSE OpenStack Cloud), 12 SP3-BCL (Suse Linux Enterprise Server), 12 SP5 (Suse Linux Enterprise Server), 12 SP5 (SUSE Linux Enterprise Server for SAP Applications), 8 (SUSE OpenStack Cloud Crowbar), 5.0 (Red Hat Satellite), 6.0 (Red Hat Satellite), 3.3 (Jboss Operations Network), 6 (SUSE Enterprise Storage), - (Red Hat Software Collections), 12 SP3-ESPOS (Suse Linux Enterprise Server), 9 (SUSE OpenStack Cloud), 9 (SUSE OpenStack Cloud Crowbar), 15-ESPOS (SUSE Linux Enterprise High Performance Computing), 15-LTSS (SUSE Linux Enterprise High Performance Computing), 15-LTSS (Suse Linux Enterprise Server), - (openSUSE Tumbleweed), 3 (Red Hat Storage), 15 SP2 (SUSE Linux Enterprise Module for Basesystem), 6 (Red Hat JBoss Data Virtualization), 3.0 (Jboss Operations Network), 15.2 (OpenSUSE Leap), 12 SP4-ESPOS (Suse Linux Enterprise Server), 12 SP4-LTSS (Suse Linux Enterprise Server), 4.0 (SUSE Manager Proxy), 4.0 (SUSE Manager Retail Branch Server), 4.0 (SUSE Manager Server), 15 SP3 (SUSE Linux Enterprise Module for Basesystem), 15 SP1 (Suse Linux Enterprise Server), 11 (Debian GNU/Linux), 12 (Debian GNU/Linux), 6 (Red Hat JBoss Fuse Service Works), 5 (Red Hat JBoss SOA Platform), 2 (Red Hat OpenShift Enterprise), 15 SP3 (SUSE Linux Enterprise High Performance Computing), 15 SP3 (Suse Linux Enterprise Server), 15 SP3 (SUSE Linux Enterprise Server for SAP Applications), 4.2 (SUSE Manager Proxy), 4.2 (SUSE Manager Server), 15 SP3 (Suse Linux Enterprise Desktop), 7 (SUSE Enterprise Storage), 15 SP2 (Suse Linux Enterprise Server), 15 SP2 (SUSE Linux Enterprise Server for SAP Applications), 4.1 (SUSE Manager Server), 4.1 (SUSE Manager Proxy), 4.1 (SUSE Manager Retail Branch Server), 15 SP4 (Suse Linux Enterprise Server), 15 SP2 (Suse Linux Enterprise Desktop), 15 SP2 (SUSE Linux Enterprise High Performance Computing), 15 SP4 (Suse Linux Enterprise Desktop), 15 SP4 (SUSE Linux Enterprise Server for SAP Applications), 4.2 (SUSE Manager Retail Branch Server), 6 (Red Hat JBoss Data Grid), 4.3 (SUSE Manager Retail Branch Server), 4.3 (SUSE Manager Proxy), 4.3 (SUSE Manager Server), 15 SP4 (SUSE Linux Enterprise High Performance Computing), 4.10 (Red Hat OpenShift Container Platform), 15 SP1 (Suse Linux Enterprise Desktop), 6.2 (Red Hat JBoss Fuse), 7.1 (SUSE Enterprise Storage), 15 SP4 (SUSE Linux Enterprise Module for Basesystem), 15 SP1 (SUSE Linux Enterprise High Performance Computing), 15 SP5 (SUSE Linux Enterprise Server for SAP Applications), 15 SP5 (Suse Linux Enterprise Server), 15 SP5 (Suse Linux Enterprise Desktop), 15 SP5 (SUSE Linux Enterprise High Performance Computing), 15 SP5 (SUSE Linux Enterprise Module for Basesystem), 6 (Red Hat JBoss Enterprise Application Platform), 5 (Red Hat JBoss Enterprise Application Platform), 7 (SUSE Liberty Linux), 15 SP6 (Suse Linux Enterprise Desktop), 15 SP6 (Suse Linux Enterprise Server), 15 SP6 (SUSE Linux Enterprise Server for SAP Applications), 15 SP6 (SUSE Linux Enterprise High Performance Computing), 15 SP6 (SUSE Linux Enterprise Module for Basesystem), 7.8.1.10 (IBM Storwize V5000), 5 for RHEL 5 (Red Hat Jboss Enterprise Web Platform), 5 for RHEL 6 (Red Hat Jboss Enterprise Web Platform), 6 (Red Hat JBoss BPMS), 6.1 (Red Hat JBoss Data Virtualization), 6.2 (Jboss Portal), 5.3 (Red Hat JBoss SOA Platform), 2.7 (Red Hat JBoss Web Framework Kit), 5.2 (Red Hat JBoss Web Platform), 3.5 (RHEV Manager), 4 (Red Hat JBoss Enterprise Application Platform), 1 (Red Hat JBoss Enterprise Web Server), 5 (Jboss Portal), 6 (Jboss Portal), \u043e\u0442 4.0.0 \u0434\u043e 4.3.4 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (HttpClient), \u043e\u0442 4.0.0 \u0434\u043e 4.0.1 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (HttpAsyncClient), 7 LTSS (SUSE Liberty Linux), 1 (Red Hat OpenShift Enterprise), 6.2 (Red Hat JBoss A-MQ), 5 (Red Hat JBoss BPMS), 5 for RHEL 4 (Red Hat JBoss Enterprise Application Platform), 5 for RHEL 5 (Red Hat JBoss Enterprise Application Platform), 5 for RHEL 6 (Red Hat JBoss Enterprise Application Platform), 5.2 (Red Hat JBoss Enterprise Application Platform), 6.3 (Red Hat JBoss Enterprise Application Platform), 6.3 for RHEL 5 (Red Hat JBoss Enterprise Application Platform), 6.3 for RHEL 6 (Red Hat JBoss Enterprise Application Platform), 6.3 for RHEL 7 (Red Hat JBoss Enterprise Application Platform), 4.3 (Red Hat JBoss SOA Platform), 2.2 (Red Hat OpenShift Enterprise), 1 for Red Hat Enterprise Linux 6 (Red Hat Software Collections), 1 for Red Hat Enterprise Linux 6.4 EUS (Red Hat Software Collections), 2.1 (Red Hat Storage)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Apache Software Foundation:\nhttps://issues.apache.org/jira/browse/DRILL-7416\n\n\u0414\u043b\u044f Debian GNU/Linux:\nhttps://security-tracker.debian.org/tracker/CVE-2014-3577\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Red Hat Inc.:\nhttps://access.redhat.com/security/cve/CVE-2014-3577\n\n\u0414\u043b\u044f Ubuntu:\nhttps://ubuntu.com/security/notices/USN-2769-1\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Novell Inc.:\nhttps://www.suse.com/security/cve/CVE-2014-3577.html\n\n\u0414\u043b\u044f IBM Storwize V5000:\n\u041a\u043e\u043c\u043f\u0435\u043d\u0441\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043c\u0435\u0440\u044b:\n- \u043c\u0438\u043d\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0445 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439;\n- \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435/\u0443\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u043d\u0435\u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439;\n- \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438\u0437 \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439 (\u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442);\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u0447\u0430\u0441\u0442\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 (VPN).",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "18.08.2014",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "29.10.2024",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "29.10.2024",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2024-08705",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2014-3577, USN-2769-1",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Red Hat Enterprise Virtualization, Red Hat Enterprise Linux, Ubuntu, SUSE Linux Enterprise Server for SAP Applications, SUSE OpenStack Cloud, Red Hat Virtualization, SUSE Linux Enterprise Module for Basesystem, SUSE Enterprise Storage, SUSE Linux Enterprise Point of Sale, Suse Linux Enterprise Server, OpenSUSE Leap, SUSE OpenStack Cloud Crowbar, Red Hat Satellite, Jboss Operations Network, Red Hat Software Collections, SUSE Linux Enterprise High Performance Computing, openSUSE Tumbleweed, Red Hat Storage, Red Hat JBoss Data Virtualization, SUSE Manager Proxy, SUSE Manager Retail Branch Server, SUSE Manager Server, Debian GNU/Linux, Red Hat JBoss Fuse Service Works, Red Hat JBoss SOA Platform, Red Hat OpenShift Enterprise, Suse Linux Enterprise Desktop, Red Hat JBoss Data Grid, Red Hat OpenShift Container Platform, Red Hat JBoss Fuse, Red Hat JBoss Enterprise Application Platform, SUSE Liberty Linux, IBM Storwize V5000, Red Hat Jboss Enterprise Web Platform, Red Hat JBoss BPMS, Jboss Portal, Red Hat JBoss Web Framework Kit, Red Hat JBoss Web Platform, RHEV Manager, Red Hat JBoss Enterprise Web Server, HttpClient, HttpAsyncClient, Red Hat JBoss A-MQ",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "Red Hat Inc. Red Hat Enterprise Virtualization 3 , Red Hat Inc. Red Hat Enterprise Linux 5 , Red Hat Inc. Red Hat Enterprise Linux 6 , Red Hat Inc. Red Hat Enterprise Linux 7 , Canonical Ltd. Ubuntu 12.04 , Canonical Ltd. Ubuntu 15.04 , Novell Inc. SUSE Linux Enterprise Server for SAP Applications 12 SP2 , Novell Inc. SUSE Linux Enterprise Server for SAP Applications 12 SP3 , Novell Inc. SUSE Linux Enterprise Server for SAP Applications 12 SP4 , Novell Inc. Suse Linux Enterprise Server 12 SP2-ESPOS , Novell Inc. OpenSUSE Leap 15.1 , Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 , Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP1 , Novell Inc. Suse Linux Enterprise Server 12 SP2-LTSS , Novell Inc. Suse Linux Enterprise Server 12 SP3-LTSS , Canonical Ltd. Ubuntu 14.04 ESM , Novell Inc. Suse Linux Enterprise Server 12 SP3-BCL , Novell Inc. Suse Linux Enterprise Server 12 SP5 , Novell Inc. SUSE Linux Enterprise Server for SAP Applications 12 SP5 , Novell Inc. Suse Linux Enterprise Server 12 SP3-ESPOS , Novell Inc. Suse Linux Enterprise Server 15-LTSS , Novell Inc. openSUSE Tumbleweed - , Novell Inc. OpenSUSE Leap 15.2 , Novell Inc. Suse Linux Enterprise Server 12 SP4-ESPOS , Novell Inc. Suse Linux Enterprise Server 12 SP4-LTSS , Novell Inc. Suse Linux Enterprise Server 15 SP1 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 11 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 12 , Novell Inc. Suse Linux Enterprise Server 15 SP3 , Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP3 , Novell Inc. Suse Linux Enterprise Desktop 15 SP3 , Novell Inc. Suse Linux Enterprise Server 15 SP2 , Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP2 , Novell Inc. Suse Linux Enterprise Server 15 SP4 , Novell Inc. Suse Linux Enterprise Desktop 15 SP2 , Novell Inc. Suse Linux Enterprise Desktop 15 SP4 , Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP4 , Novell Inc. Suse Linux Enterprise Desktop 15 SP1 , Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP5 , Novell Inc. Suse Linux Enterprise Server 15 SP5 , Novell Inc. Suse Linux Enterprise Desktop 15 SP5 , Novell Inc. SUSE Liberty Linux 7 , Novell Inc. Suse Linux Enterprise Desktop 15 SP6 , Novell Inc. Suse Linux Enterprise Server 15 SP6 , Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP6 , Novell Inc. SUSE Liberty Linux 7 LTSS ",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u0433\u043e \u043c\u043e\u0434\u0443\u043b\u044f Apache HttpClient \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 Apache HttpComponents, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c SSL-\u0441\u0435\u0440\u0432\u0435\u0440\u044b",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0445\u043e\u0441\u0442\u043e\u0432\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 (CWE-297)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u0433\u043e \u043c\u043e\u0434\u0443\u043b\u044f Apache HttpClient \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 Apache HttpComponents \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u044b\u043c \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u0435\u043c \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 SSL/TLS. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c SSL-\u0441\u0435\u0440\u0432\u0435\u0440\u044b \u043f\u0443\u0442\u0435\u043c \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u0432 \u043f\u043e\u043b\u0435 distincted name (DN)",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041f\u043e\u0434\u043c\u0435\u043d\u0430 \u043f\u0440\u0438 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://issues.apache.org/jira/browse/DRILL-7416\nhttps://seclists.org/fulldisclosure/2014/Aug/48\nhttps://security-tracker.debian.org/tracker/CVE-2014-3577\nhttps://access.redhat.com/security/cve/CVE-2014-3577\nhttps://ubuntu.com/security/notices/USN-2769-1\nhttps://www.suse.com/security/cve/CVE-2014-3577.html",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430, \u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c, \u041f\u041e \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438/\u041f\u041e \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430, \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e, \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-297",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,4)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,5)"
}

usn-2769-1

Vulnerability from osv_ubuntu

Published

2015-10-14 15:43

Modified

2026-02-10 04:40

Summary

commons-httpclient vulnerabilities

Details

It was discovered that Apache Commons HttpClient did not properly verify the Common Name or subjectAltName fields of X.509 certificates. An attacker could exploit this to perform a machine-in-the-middle attack to view sensitive information or alter encrypted communications. This issue only affected Ubuntu 12.04 LTS. (CVE-2012-5783)

Florian Weimer discovered the fix for CVE-2012-5783 was incomplete for Apache Commons HttpClient. An attacker could exploit this to perform a machine-in-the-middle attack to view sensitive information or alter encrypted communications. This issue only affected Ubuntu 12.04 LTS. (CVE-2012-6153)

Subodh Iyengar and Will Shackleton discovered the fix for CVE-2012-5783 was incomplete for Apache Commons HttpClient. An attacker could exploit this to perform a machine-in-the-middle attack to view sensitive information or alter encrypted communications. (CVE-2014-3577)

It was discovered that Apache Commons HttpClient did not properly handle read timeouts during HTTPS handshakes. A remote attacker could trigger this flaw to cause a denial of service. (CVE-2015-5262)

References

URL

Type

	https://ubuntu.com/security/notices/USN-2769-1	ADVISORY
	https://ubuntu.com/security/CVE-2012-5783	REPORT
	https://ubuntu.com/security/CVE-2012-6153	REPORT
	https://ubuntu.com/security/CVE-2014-3577	REPORT
	https://ubuntu.com/security/CVE-2015-5262	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2014-3577",
              "severity": [
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2015-5262",
              "severity": [
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:14.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libcommons-httpclient-java",
            "binary_version": "3.1-10.2ubuntu0.14.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "commons-httpclient",
        "purl": "pkg:deb/ubuntu/commons-httpclient@3.1-10.2ubuntu0.14.04.1?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1-10.2ubuntu0.14.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.1-10.2"
      ]
    }
  ],
  "aliases": [],
  "details": "It was discovered that Apache Commons HttpClient did not properly verify the\nCommon Name or subjectAltName fields of X.509 certificates. An attacker could\nexploit this to perform a machine-in-the-middle attack to view sensitive\ninformation or alter encrypted communications. This issue only affected Ubuntu\n12.04 LTS. (CVE-2012-5783)\n\nFlorian Weimer discovered the fix for CVE-2012-5783 was incomplete for Apache\nCommons HttpClient. An attacker could exploit this to perform a\nmachine-in-the-middle attack to view sensitive information or alter\nencrypted communications. This issue only affected Ubuntu 12.04 LTS.\n(CVE-2012-6153)\n\nSubodh Iyengar and Will Shackleton discovered the fix for CVE-2012-5783 was\nincomplete for Apache Commons HttpClient. An attacker could exploit this to\nperform a machine-in-the-middle attack to view sensitive information or alter\nencrypted communications. (CVE-2014-3577)\n\nIt was discovered that Apache Commons HttpClient did not properly handle read\ntimeouts during HTTPS handshakes. A remote attacker could trigger this flaw to\ncause a denial of service. (CVE-2015-5262)\n",
  "id": "USN-2769-1",
  "modified": "2026-02-10T04:40:55Z",
  "published": "2015-10-14T15:43:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-2769-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2012-5783"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2012-6153"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2014-3577"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2015-5262"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "commons-httpclient vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2012-5783",
    "UBUNTU-CVE-2012-6153",
    "UBUNTU-CVE-2014-3577",
    "UBUNTU-CVE-2015-5262"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

BDU:2024-08705

usn-2769-1

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature