CVE-2014-3577 Medium Severity Vulnerability detected by WhiteSource

[mend-bolt-for-github]

CVE-2014-3577 - Medium Severity Vulnerability

Vulnerable Library - httpclient-4.0.1.jar

HttpComponents Client (base module)

path: /root/.m2/repository/org/apache/httpcomponents/httpclient/4.0.1/httpclient-4.0.1.jar

Library home page: http://hc.apache.org/httpcomponents-client

Dependency Hierarchy:

• geoip2-0.7.1.jar (Root Library)
  • google-http-client-1.17.0-rc.jar
    • ❌ httpclient-4.0.1.jar (Vulnerable Library)

Vulnerability Details

org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field.

Publish Date: 2014-08-21

URL: CVE-2014-3577

CVSS 2 Score Details (5.8)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: http://www.securitytracker.com/id/1030812

Fix Resolution: The vendor has issued a fix.

The vendor's advisories are available at:

https://rhn.redhat.com/errata/RHSA-2014-1162.html
https://rhn.redhat.com/errata/RHSA-2014-1163.html
https://rhn.redhat.com/errata/RHSA-2014-2019.html
https://rhn.redhat.com/errata/RHSA-2014-2020.html

---

Step up your Open Source Security Game with WhiteSource here