CVE-2012-5783
Fixed in a distro release EPSS 9%
Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Products: apache httpclient, canonical ubuntu_linux
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | commons-httpclient:commons-httpclient | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | apicurio-registry | 3.0.6-r2 |
| Chainguard | apicurio-registry-nginx-config | 3.0.6-r2 |
| Chainguard | apicurio-registry-ui | 3.0.6-r2 |
| Chainguard | hadoop-fips-3.3.6 | 3.3.6-r15 |
| Chainguard | trino | 445-r0 |
| Chainguard | trino-config | 445-r0 |
| Chainguard | trino-oci-entrypoint | 445-r0 |
| Chainguard | trino-plugin-ai-functions | 445-r0 |
| Chainguard | trino-plugin-bigquery | 445-r0 |
| Chainguard | trino-plugin-blackhole | 445-r0 |
| Chainguard | trino-plugin-cassandra | 445-r0 |
| Chainguard | trino-plugin-clickhouse | 445-r0 |
| Chainguard | trino-plugin-delta-lake | 445-r0 |
| Chainguard | trino-plugin-druid | 445-r0 |
| Chainguard | trino-plugin-duckdb | 445-r0 |
| Chainguard | trino-plugin-elasticsearch | 445-r0 |
| Chainguard | trino-plugin-exasol | 445-r0 |
| Chainguard | trino-plugin-exchange-filesystem | 445-r0 |
| Chainguard | trino-plugin-exchange-hdfs | 445-r0 |
| Chainguard | trino-plugin-faker | 445-r0 |
| Chainguard | trino-plugin-functions-python | 445-r0 |
| Chainguard | trino-plugin-geospatial | 445-r0 |
| Chainguard | trino-plugin-google-sheets | 445-r0 |
| Chainguard | trino-plugin-hive | 445-r0 |
| Chainguard | trino-plugin-http-event-listener | 445-r0 |
| Chainguard | trino-plugin-http-server-event-listener | 445-r0 |
| Chainguard | trino-plugin-hudi | 445-r0 |
| Chainguard | trino-plugin-iceberg | 445-r0 |
| Chainguard | trino-plugin-ignite | 445-r0 |
| Chainguard | trino-plugin-jmx | 445-r0 |
| Chainguard | trino-plugin-kafka | 445-r0 |
| Chainguard | trino-plugin-kafka-event-listener | 445-r0 |
| Chainguard | trino-plugin-lakehouse | 445-r0 |
| Chainguard | trino-plugin-ldap-group-provider | 445-r0 |
| Chainguard | trino-plugin-loki | 445-r0 |
| Chainguard | trino-plugin-mariadb | 445-r0 |
| Chainguard | trino-plugin-memory | 445-r0 |
| Chainguard | trino-plugin-ml | 445-r0 |
| Chainguard | trino-plugin-mongodb | 445-r0 |
| Chainguard | trino-plugin-mysql | 445-r0 |
| Chainguard | trino-plugin-mysql-event-listener | 445-r0 |
| Chainguard | trino-plugin-opa | 445-r0 |
| Chainguard | trino-plugin-openlineage | 445-r0 |
| Chainguard | trino-plugin-opensearch | 445-r0 |
| Chainguard | trino-plugin-oracle | 445-r0 |
| Chainguard | trino-plugin-password-authenticators | 445-r0 |
| Chainguard | trino-plugin-pinot | 445-r0 |
| Chainguard | trino-plugin-postgresql | 445-r0 |
| Chainguard | trino-plugin-prometheus | 445-r0 |
| Chainguard | trino-plugin-ranger | 445-r0 |
| Chainguard | trino-plugin-redis | 445-r0 |
| Chainguard | trino-plugin-redshift | 445-r0 |
| Chainguard | trino-plugin-resource-group-managers | 445-r0 |
| Chainguard | trino-plugin-session-property-managers | 445-r0 |
| Chainguard | trino-plugin-singlestore | 445-r0 |
| Chainguard | trino-plugin-snowflake | 445-r0 |
| Chainguard | trino-plugin-spooling-filesystem | 445-r0 |
| Chainguard | trino-plugin-sqlserver | 445-r0 |
| Chainguard | trino-plugin-teradata-functions | 445-r0 |
| Chainguard | trino-plugin-thrift | 445-r0 |
| Chainguard | trino-plugin-tpcds | 445-r0 |
| Chainguard | trino-plugin-tpch | 445-r0 |
| Chainguard | trino-plugin-vertica | 445-r0 |
| Chainguard | zaproxy | 2.16.1-r0 |
| Debian 12 | commons-httpclient | 3.1-10.1 |
| Debian 13 | commons-httpclient | 3.1-10.1 |
| Debian 14 | commons-httpclient | 3.1-10.1 |
| Debian 6.0 | commons-httpclient | 3.1-9+deb6u1 |
| Red Hat Enterprise Linux 5 | jakarta-commons-httpclient | 1:3.0-7jpp.2 |
| Red Hat Enterprise Linux 5 | jakarta-commons-httpclient-debuginfo | 1:3.0-7jpp.2 |
| Red Hat Enterprise Linux 5 | jakarta-commons-httpclient-demo | 1:3.0-7jpp.2 |
| Red Hat Enterprise Linux 5 | jakarta-commons-httpclient-javadoc | 1:3.0-7jpp.2 |
| Red Hat Enterprise Linux 5 | jakarta-commons-httpclient-manual | 1:3.0-7jpp.2 |
| Red Hat Enterprise Linux 6 | jakarta-commons-httpclient | 1:3.1-0.7.el6_3 |
| Red Hat Enterprise Linux 6 | jakarta-commons-httpclient-debuginfo | 1:3.1-0.7.el6_3 |
| Red Hat Enterprise Linux 6 | jakarta-commons-httpclient-demo | 1:3.1-0.7.el6_3 |
| Red Hat Enterprise Linux 6 | jakarta-commons-httpclient-javadoc | 1:3.1-0.7.el6_3 |
| Red Hat Enterprise Linux 6 | jakarta-commons-httpclient-manual | 1:3.1-0.7.el6_3 |
| Red Hat jboss enterprise application platform 5 | jakarta-commons-httpclient | 1:3.1-2.1_patch_01.ep5.el4 |
| Red Hat jboss enterprise application platform 5 | jakarta-commons-httpclient | 1:3.1-2.1_patch_01.ep5.el5 |
| Red Hat jboss enterprise application platform 5 | jakarta-commons-httpclient | 1:3.1-2_patch_01.ep5.el6 |
| Red Hat jboss enterprise web platform 5 | jakarta-commons-httpclient | 1:3.1-2.1_patch_01.ep5.el5 |
| Red Hat jboss enterprise web platform 5 | jakarta-commons-httpclient | 1:3.1-2_patch_01.ep5.el6 |
| Red Hat rhev manager 3 | redhat-support-plugin-rhev | 0:3.3.0-14.el6ev |
| Ubuntu 14.04 LTS | commons-httpclient | 3.1-10.2ubuntu0.14.04.1 |
| Wolfi | apicurio-registry | 3.0.6-r2 |
| Wolfi | apicurio-registry-nginx-config | 3.0.6-r2 |
| Wolfi | apicurio-registry-ui | 3.0.6-r2 |
| Wolfi | trino | 445-r0 |
| Wolfi | trino-config | 445-r0 |
| Wolfi | trino-oci-entrypoint | 445-r0 |
| Wolfi | trino-plugin-ai-functions | 445-r0 |
| Wolfi | trino-plugin-bigquery | 445-r0 |
| Wolfi | trino-plugin-blackhole | 445-r0 |
| Wolfi | trino-plugin-cassandra | 445-r0 |
| Wolfi | trino-plugin-clickhouse | 445-r0 |
| Wolfi | trino-plugin-delta-lake | 445-r0 |
| Wolfi | trino-plugin-druid | 445-r0 |
| Wolfi | trino-plugin-duckdb | 445-r0 |
| Wolfi | trino-plugin-elasticsearch | 445-r0 |
| Wolfi | trino-plugin-exasol | 445-r0 |
| Wolfi | trino-plugin-exchange-filesystem | 445-r0 |
| Wolfi | trino-plugin-exchange-hdfs | 445-r0 |
| Wolfi | trino-plugin-faker | 445-r0 |
| Wolfi | trino-plugin-functions-python | 445-r0 |
| Wolfi | trino-plugin-geospatial | 445-r0 |
| Wolfi | trino-plugin-google-sheets | 445-r0 |
| Wolfi | trino-plugin-hive | 445-r0 |
| Wolfi | trino-plugin-http-event-listener | 445-r0 |
| Wolfi | trino-plugin-http-server-event-listener | 445-r0 |
| Wolfi | trino-plugin-hudi | 445-r0 |
| Wolfi | trino-plugin-iceberg | 445-r0 |
| Wolfi | trino-plugin-ignite | 445-r0 |
| Wolfi | trino-plugin-jmx | 445-r0 |
| Wolfi | trino-plugin-kafka | 445-r0 |
| Wolfi | trino-plugin-kafka-event-listener | 445-r0 |
| Wolfi | trino-plugin-lakehouse | 445-r0 |
| Wolfi | trino-plugin-ldap-group-provider | 445-r0 |
| Wolfi | trino-plugin-loki | 445-r0 |
| Wolfi | trino-plugin-mariadb | 445-r0 |
| Wolfi | trino-plugin-memory | 445-r0 |
| Wolfi | trino-plugin-ml | 445-r0 |
| Wolfi | trino-plugin-mongodb | 445-r0 |
| Wolfi | trino-plugin-mysql | 445-r0 |
| Wolfi | trino-plugin-mysql-event-listener | 445-r0 |
| Wolfi | trino-plugin-opa | 445-r0 |
| Wolfi | trino-plugin-openlineage | 445-r0 |
| Wolfi | trino-plugin-opensearch | 445-r0 |
| Wolfi | trino-plugin-oracle | 445-r0 |
| Wolfi | trino-plugin-password-authenticators | 445-r0 |
| Wolfi | trino-plugin-pinot | 445-r0 |
| Wolfi | trino-plugin-postgresql | 445-r0 |
| Wolfi | trino-plugin-prometheus | 445-r0 |
| Wolfi | trino-plugin-ranger | 445-r0 |
| Wolfi | trino-plugin-redis | 445-r0 |
| Wolfi | trino-plugin-redshift | 445-r0 |
| Wolfi | trino-plugin-resource-group-managers | 445-r0 |
| Wolfi | trino-plugin-session-property-managers | 445-r0 |
| Wolfi | trino-plugin-singlestore | 445-r0 |
| Wolfi | trino-plugin-snowflake | 445-r0 |
| Wolfi | trino-plugin-spooling-filesystem | 445-r0 |
| Wolfi | trino-plugin-sqlserver | 445-r0 |
| Wolfi | trino-plugin-teradata-functions | 445-r0 |
| Wolfi | trino-plugin-thrift | 445-r0 |
| Wolfi | trino-plugin-tpcds | 445-r0 |
| Wolfi | trino-plugin-tpch | 445-r0 |
| Wolfi | trino-plugin-vertica | 445-r0 |
| openSUSE Tumbleweed | apache-commons-httpclient | 3.1-8.5 |