CVE-2013-4366
Fixed in a distro release EPSS 3%
http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509HostnameVerifier is not null, which allows attackers to have unspecified impact via vectors involving hostname verification.
Products: apache httpclient
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.httpcomponents:httpclient | 4.3.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | httpcomponents-client | 4.3.2-1 |
| Debian 13 | httpcomponents-client | 4.3.2-1 |
| Debian 14 | httpcomponents-client | 4.3.2-1 |