CVE-2014-3577
Fixed in a distro release EPSS 9%
org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field.
Products: apache httpclient, apache httpasyncclient
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.httpcomponents:httpclient | 4.3.5 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Arch Linux | jenkins | 2.315-1 |
| Chainguard | eco-java-gradle-1.11 | no fix |
| Chainguard | eco-java-gradle-2.0 | no fix |
| Chainguard | eco-java-gradle-2.1 | no fix |
| Chainguard | eco-java-gradle-2.10 | no fix |
| Chainguard | eco-java-gradle-2.2 | no fix |
| Chainguard | eco-java-gradle-2.2.1 | no fix |
| Chainguard | eco-java-gradle-2.3 | no fix |
| Chainguard | eco-java-gradle-2.4 | no fix |
| Chainguard | eco-java-gradle-2.5 | no fix |
| Chainguard | eco-java-gradle-2.6 | no fix |
| Chainguard | eco-java-gradle-2.7 | no fix |
| Chainguard | eco-java-gradle-2.8 | no fix |
| Chainguard | eco-java-gradle-2.9 | no fix |
| Chainguard | hadoop-fips-3.3.6 | no fix |
| Chainguard | hadoop-fips-3.4.2 | no fix |
| Chainguard | hadoop-fips-3.5 | no fix |
| Debian 12 | commons-httpclient | 3.1-11 |
| Debian 12 | httpcomponents-client | 4.3.5-1 |
| Debian 13 | commons-httpclient | 3.1-11 |
| Debian 13 | httpcomponents-client | 4.3.5-1 |
| Debian 14 | commons-httpclient | 3.1-11 |
| Debian 14 | httpcomponents-client | 4.3.5-1 |
| Debian 6.0 | commons-httpclient | 3.1-9+deb6u1 |
| Red Hat Enterprise Linux 5 | jakarta-commons-httpclient | 1:3.0-7jpp.4.el5_10 |
| Red Hat Enterprise Linux 5 | jakarta-commons-httpclient-debuginfo | 1:3.0-7jpp.4.el5_10 |
| Red Hat Enterprise Linux 5 | jakarta-commons-httpclient-demo | 1:3.0-7jpp.4.el5_10 |
| Red Hat Enterprise Linux 5 | jakarta-commons-httpclient-javadoc | 1:3.0-7jpp.4.el5_10 |
| Red Hat Enterprise Linux 5 | jakarta-commons-httpclient-manual | 1:3.0-7jpp.4.el5_10 |
| Red Hat Enterprise Linux 6 | jakarta-commons-httpclient | 1:3.1-0.9.el6_5 |
| Red Hat Enterprise Linux 6 | jakarta-commons-httpclient-debuginfo | 1:3.1-0.9.el6_5 |
| Red Hat Enterprise Linux 6 | jakarta-commons-httpclient-demo | 1:3.1-0.9.el6_5 |
| Red Hat Enterprise Linux 6 | jakarta-commons-httpclient-javadoc | 1:3.1-0.9.el6_5 |
| Red Hat Enterprise Linux 6 | jakarta-commons-httpclient-manual | 1:3.1-0.9.el6_5 |
| Red Hat Enterprise Linux 7 | httpcomponents-client | 0:4.2.5-5.el7_0 |
| Red Hat Enterprise Linux 7 | httpcomponents-client-javadoc | 0:4.2.5-5.el7_0 |
| Red Hat Enterprise Linux 7 | jakarta-commons-httpclient | 1:3.1-16.el7_0 |
| Red Hat Enterprise Linux 7 | jakarta-commons-httpclient-demo | 1:3.1-16.el7_0 |
| Red Hat Enterprise Linux 7 | jakarta-commons-httpclient-javadoc | 1:3.1-16.el7_0 |
| Red Hat Enterprise Linux 7 | jakarta-commons-httpclient-manual | 1:3.1-16.el7_0 |
| Red Hat jboss enterprise application platform 5 | apache-cxf | 0:2.2.12-14.patch_09.ep5.el4 |
| Red Hat jboss enterprise application platform 5 | apache-cxf | 0:2.2.12-14.patch_09.el6 |
| Red Hat jboss enterprise application platform 5 | apache-cxf | 0:2.2.12-14.patch_09.ep5.el5 |
| Red Hat jboss enterprise application platform 5 | jakarta-commons-httpclient | 1:3.1-4_patch_02.ep5.el4 |
| Red Hat jboss enterprise application platform 5 | jakarta-commons-httpclient | 1:3.1-4_patch_02.ep5.el5 |
| Red Hat jboss enterprise application platform 5 | jakarta-commons-httpclient | 1:3.1-4_patch_02.el6_5 |
| Red Hat jboss enterprise application platform 5 | jboss-seam2 | 0:2.2.6.EAP5-22_patch_01.ep5.el5 |
| Red Hat jboss enterprise application platform 5 | jboss-seam2 | 0:2.2.6.EAP5-22_patch_01.ep5.el4 |
| Red Hat jboss enterprise application platform 5 | jboss-seam2 | 0:2.2.6.EAP5-22_patch_01.el6 |
| Red Hat jboss enterprise application platform 5 | jboss-seam2-docs | 0:2.2.6.EAP5-22_patch_01.el6 |
| Red Hat jboss enterprise application platform 5 | jboss-seam2-docs | 0:2.2.6.EAP5-22_patch_01.ep5.el4 |
| Red Hat jboss enterprise application platform 5 | jboss-seam2-docs | 0:2.2.6.EAP5-22_patch_01.ep5.el5 |
| Red Hat jboss enterprise application platform 5 | jboss-seam2-examples | 0:2.2.6.EAP5-22_patch_01.ep5.el5 |
| Red Hat jboss enterprise application platform 5 | jboss-seam2-examples | 0:2.2.6.EAP5-22_patch_01.ep5.el4 |
| Red Hat jboss enterprise application platform 5 | jboss-seam2-examples | 0:2.2.6.EAP5-22_patch_01.el6 |
| Red Hat jboss enterprise application platform 5 | jboss-seam2-runtime | 0:2.2.6.EAP5-22_patch_01.ep5.el5 |
| Red Hat jboss enterprise application platform 5 | jboss-seam2-runtime | 0:2.2.6.EAP5-22_patch_01.el6 |
| Red Hat jboss enterprise application platform 5 | jboss-seam2-runtime | 0:2.2.6.EAP5-22_patch_01.ep5.el4 |
| Red Hat jboss enterprise application platform 6 | apache-cxf | 0:2.7.12-1.SP1_redhat_5.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | apache-cxf | 0:2.7.12-1.SP1_redhat_5.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | apache-cxf | 0:2.7.12-1.SP1_redhat_5.1.ep6.el7 |
| Red Hat jboss enterprise application platform 6 | httpclient-eap6 | 0:4.2.1-12.redhat_2.1.ep6.el7 |
| Red Hat jboss enterprise application platform 6 | httpclient-eap6 | 0:4.2.1-12.redhat_2.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | httpclient-eap6 | 0:4.2.1-12.redhat_2.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | httpcomponents-client-eap6 | 0:4.2.1-12.redhat_2.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | httpcomponents-client-eap6 | 0:4.2.1-12.redhat_2.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | httpcomponents-client-eap6 | 0:4.2.1-12.redhat_2.1.ep6.el7 |
| Red Hat jboss enterprise application platform 6 | httpcomponents-core-eap6 | 0:4.2.1-12.redhat_2.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | httpcomponents-core-eap6 | 0:4.2.1-12.redhat_2.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | httpcomponents-core-eap6 | 0:4.2.1-12.redhat_2.1.ep6.el7 |
| Red Hat jboss enterprise application platform 6 | httpcomponents-eap6 | 0:6-12.redhat_2.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | httpcomponents-eap6 | 0:6-12.redhat_2.1.ep6.el7 |
| Red Hat jboss enterprise application platform 6 | httpcomponents-eap6 | 0:6-12.redhat_2.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | httpcomponents-project-eap6 | 0:6-12.redhat_2.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | httpcomponents-project-eap6 | 0:6-12.redhat_2.1.ep6.el7 |
| Red Hat jboss enterprise application platform 6 | httpcomponents-project-eap6 | 0:6-12.redhat_2.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | httpcore-eap6 | 0:4.2.1-12.redhat_2.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | httpcore-eap6 | 0:4.2.1-12.redhat_2.1.ep6.el7 |
| Red Hat jboss enterprise application platform 6 | httpcore-eap6 | 0:4.2.1-12.redhat_2.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | httpmime-eap6 | 0:4.2.1-12.redhat_2.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | httpmime-eap6 | 0:4.2.1-12.redhat_2.1.ep6.el7 |
| Red Hat jboss enterprise application platform 6 | httpmime-eap6 | 0:4.2.1-12.redhat_2.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | wss4j | 0:1.6.16-2.redhat_3.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | wss4j | 0:1.6.16-2.redhat_3.1.ep6.el7 |
| Red Hat jboss enterprise application platform 6 | wss4j | 0:1.6.16-2.redhat_3.1.ep6.el5 |
| Red Hat jboss enterprise web platform 5 | apache-cxf | 0:2.2.12-14.patch_09.el6 |
| Red Hat jboss enterprise web platform 5 | apache-cxf | 0:2.2.12-14.patch_09.ep5.el5 |
| Red Hat jboss enterprise web platform 5 | jakarta-commons-httpclient | 1:3.1-4_patch_02.el6_5 |
| Red Hat jboss enterprise web platform 5 | jakarta-commons-httpclient | 1:3.1-4_patch_02.ep5.el5 |
| Red Hat jboss enterprise web platform 5 | jboss-seam2 | 0:2.2.6.EAP5-22_patch_01.el6 |
| Red Hat jboss enterprise web platform 5 | jboss-seam2 | 0:2.2.6.EAP5-22_patch_01.ep5.el5 |
| Red Hat jboss enterprise web platform 5 | jboss-seam2-docs | 0:2.2.6.EAP5-22_patch_01.ep5.el5 |
| Red Hat jboss enterprise web platform 5 | jboss-seam2-docs | 0:2.2.6.EAP5-22_patch_01.el6 |
| Red Hat jboss enterprise web platform 5 | jboss-seam2-examples | 0:2.2.6.EAP5-22_patch_01.ep5.el5 |
| Red Hat jboss enterprise web platform 5 | jboss-seam2-examples | 0:2.2.6.EAP5-22_patch_01.el6 |
| Red Hat jboss enterprise web platform 5 | jboss-seam2-runtime | 0:2.2.6.EAP5-22_patch_01.ep5.el5 |
| Red Hat jboss enterprise web platform 5 | jboss-seam2-runtime | 0:2.2.6.EAP5-22_patch_01.el6 |
| Red Hat openshift 2.0 | ImageMagick | 0:6.7.2.7-5.el6_8 |
| Red Hat openshift 2.0 | ImageMagick-debuginfo | 0:6.7.2.7-5.el6_8 |
| Red Hat openshift 2.0 | ImageMagick-devel | 0:6.7.2.7-5.el6_8 |
| Red Hat openshift 2.0 | ImageMagick-doc | 0:6.7.2.7-5.el6_8 |
| Red Hat openshift 2.0 | ImageMagick-perl | 0:6.7.2.7-5.el6_8 |
| Red Hat openshift 2.0 | activemq | 0:5.9.0-6.redhat.611463.el6op |
| Red Hat openshift 2.0 | activemq-client | 0:5.9.0-6.redhat.611463.el6op |
| Red Hat openshift 2.0 | jenkins | 0:1.651.2-1.el6op |
| Red Hat openshift 2.0 | libcgroup | 0:0.40.rc1-18.el6_8 |
| Red Hat openshift 2.0 | libcgroup-debuginfo | 0:0.40.rc1-18.el6_8 |
| Red Hat openshift 2.0 | libcgroup-pam | 0:0.40.rc1-18.el6_8 |
| Red Hat openshift 2.0 | openshift-origin-broker | 0:1.16.3.2-1.el6op |
| Red Hat openshift 2.0 | openshift-origin-broker-util | 0:1.37.6.2-1.el6op |
| Red Hat openshift 2.0 | openshift-origin-cartridge-cron | 0:1.25.4.2-1.el6op |
| Red Hat openshift 2.0 | openshift-origin-cartridge-diy | 0:1.26.2.2-1.el6op |
| Red Hat openshift 2.0 | openshift-origin-cartridge-haproxy | 0:1.31.6.2-1.el6op |
| Red Hat openshift 2.0 | openshift-origin-cartridge-jbosseap | 0:2.27.4.2-1.el6op |
| Red Hat openshift 2.0 | openshift-origin-cartridge-jbossews | 0:1.35.5.2-1.el6op |
| Red Hat openshift 2.0 | openshift-origin-cartridge-jenkins | 0:1.29.2.2-1.el6op |
| Red Hat openshift 2.0 | openshift-origin-cartridge-jenkins-client | 0:1.26.1.1-1.el6op |
| Red Hat openshift 2.0 | openshift-origin-cartridge-mongodb | 0:1.26.2.2-1.el6op |
| Red Hat openshift 2.0 | openshift-origin-cartridge-mysql | 0:1.31.3.3-1.el6op |
| Red Hat openshift 2.0 | openshift-origin-cartridge-nodejs | 0:1.33.1.2-1.el6op |
| Red Hat openshift 2.0 | openshift-origin-cartridge-perl | 0:1.30.2.2-1.el6op |
| Red Hat openshift 2.0 | openshift-origin-cartridge-php | 0:1.35.4.2-1.el6op |
| Red Hat openshift 2.0 | openshift-origin-cartridge-python | 0:1.34.3.2-1.el6op |
| Red Hat openshift 2.0 | openshift-origin-cartridge-ruby | 0:1.32.2.2-1.el6op |
| Red Hat openshift 2.0 | openshift-origin-msg-node-mcollective | 0:1.30.2.2-1.el6op |
| Red Hat openshift 2.0 | openshift-origin-node-proxy | 0:1.26.3.1-1.el6op |
| Red Hat openshift 2.0 | openshift-origin-node-util | 0:1.38.7.1-1.el6op |
| Red Hat openshift 2.0 | rhc | 0:1.38.7.1-1.el6op |
| Red Hat openshift 2.0 | rubygem-openshift-origin-admin-console | 0:1.28.2.1-1.el6op |
| Red Hat openshift 2.0 | rubygem-openshift-origin-controller | 0:1.38.6.4-1.el6op |
| Red Hat openshift 2.0 | rubygem-openshift-origin-frontend-haproxy-sni-proxy | 0:0.5.2.1-1.el6op |
| Red Hat openshift 2.0 | rubygem-openshift-origin-msg-broker-mcollective | 0:1.36.2.4-1.el6op |
| Red Hat openshift 2.0 | rubygem-openshift-origin-node | 0:1.38.6.4-1.el6op |
| Red Hat openshift 2.0 | rubygem-openshift-origin-routing-daemon | 0:0.26.6.1-1.el6op |
| Red Hat openshift 4.10 | coreos-installer | 0:0.12.0-1.rhaos4.10.el8 |
| Red Hat openshift 4.10 | coreos-installer-bootinfra | 0:0.12.0-1.rhaos4.10.el8 |
| Red Hat openshift 4.10 | coreos-installer-bootinfra-debuginfo | 0:0.12.0-1.rhaos4.10.el8 |
| Red Hat openshift 4.10 | coreos-installer-debuginfo | 0:0.12.0-1.rhaos4.10.el8 |
| Red Hat openshift 4.10 | coreos-installer-debugsource | 0:0.12.0-1.rhaos4.10.el8 |
| Red Hat openshift 4.10 | cri-o | 0:1.23.0-92.rhaos4.10.gitdaab4d1.el7 |
| Red Hat openshift 4.10 | cri-o | 0:1.23.1-9.rhaos4.10.gitbdffb9a.el8 |
| Red Hat openshift 4.10 | cri-o-debuginfo | 0:1.23.0-92.rhaos4.10.gitdaab4d1.el7 |
| Red Hat openshift 4.10 | cri-o-debuginfo | 0:1.23.1-9.rhaos4.10.gitbdffb9a.el8 |
| Red Hat openshift 4.10 | cri-o-debugsource | 0:1.23.1-9.rhaos4.10.gitbdffb9a.el8 |
| Red Hat openshift 4.10 | jenkins | 0:2.319.2.1643288987-1.el8 |
| Red Hat openshift 4.10 | jenkins-2-plugins | 0:4.10.1643404185-1.el8 |
| Red Hat openshift 4.10 | openshift | 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el7 |
| Red Hat openshift 4.10 | openshift | 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el8 |
| Red Hat openshift 4.10 | openshift-clients | 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el7 |
| Red Hat openshift 4.10 | openshift-clients | 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el8 |
| Red Hat openshift 4.10 | openshift-clients-redistributable | 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el7 |
| Red Hat openshift 4.10 | openshift-clients-redistributable | 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el8 |
| Red Hat openshift 4.10 | openshift-hyperkube | 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el8 |
| Red Hat openshift 4.10 | openshift-hyperkube | 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el7 |
| Red Hat rhel software collections 1 | thermostat1-httpcomponents-client | 0:4.2.5-3.4.el6.1 |
| Red Hat rhel software collections 1 | thermostat1-httpcomponents-client-javadoc | 0:4.2.5-3.4.el6.1 |
| Red Hat rhev manager 3 | rhevm | 0:3.5.0-0.29.el6ev |
| Red Hat rhev manager 3 | rhevm-backend | 0:3.5.0-0.29.el6ev |
| Red Hat rhev manager 3 | rhevm-dbscripts | 0:3.5.0-0.29.el6ev |
| Red Hat rhev manager 3 | rhevm-extensions-api-impl | 0:3.5.0-0.29.el6ev |
| Red Hat rhev manager 3 | rhevm-extensions-api-impl-javadoc | 0:3.5.0-0.29.el6ev |
| Red Hat rhev manager 3 | rhevm-lib | 0:3.5.0-0.29.el6ev |
| Red Hat rhev manager 3 | rhevm-restapi | 0:3.5.0-0.29.el6ev |
| Red Hat rhev manager 3 | rhevm-setup | 0:3.5.0-0.29.el6ev |
| Red Hat rhev manager 3 | rhevm-setup-base | 0:3.5.0-0.29.el6ev |
| Red Hat rhev manager 3 | rhevm-setup-plugin-allinone | 0:3.5.0-0.29.el6ev |
| Red Hat rhev manager 3 | rhevm-setup-plugin-ovirt-engine | 0:3.5.0-0.29.el6ev |
| Red Hat rhev manager 3 | rhevm-setup-plugin-ovirt-engine-common | 0:3.5.0-0.29.el6ev |
| Red Hat rhev manager 3 | rhevm-setup-plugin-websocket-proxy | 0:3.5.0-0.29.el6ev |
| Red Hat rhev manager 3 | rhevm-tools | 0:3.5.0-0.29.el6ev |
| Red Hat rhev manager 3 | rhevm-userportal | 0:3.5.0-0.29.el6ev |
| Red Hat rhev manager 3 | rhevm-webadmin-portal | 0:3.5.0-0.29.el6ev |
| Red Hat rhev manager 3 | rhevm-websocket-proxy | 0:3.5.0-0.29.el6ev |
| SUSE Enterprise Storage 5 | apache-commons-httpclient | 3.1-6.3.1 |
| SUSE HPE Helion OpenStack 8 | apache-commons-httpclient | 3.1-6.3.1 |
| SUSE Linux Enterprise High Performance Computing 15-ESPOS | apache-commons-httpclient | 3.1-4.3.2 |
| SUSE Linux Enterprise High Performance Computing 15-LTSS | apache-commons-httpclient | 3.1-4.3.2 |
| SUSE Linux Enterprise Module for Basesystem 15 SP1 | apache-commons-httpclient | 3.1-4.3.2 |
| SUSE Linux Enterprise Module for Basesystem 15 SP2 | apache-commons-httpclient | 3.1-11.3.2 |
| SUSE Linux Enterprise Server 12 SP2-BCL | apache-commons-httpclient | 3.1-6.3.1 |
| SUSE Linux Enterprise Server 12 SP2-LTSS | apache-commons-httpclient | 3.1-6.3.1 |
| SUSE Linux Enterprise Server 12 SP3-BCL | apache-commons-httpclient | 3.1-6.3.1 |
| SUSE Linux Enterprise Server 12 SP3-LTSS | apache-commons-httpclient | 3.1-6.3.1 |
| SUSE Linux Enterprise Server 12 SP4-LTSS | apache-commons-httpclient | 3.1-6.3.1 |
| SUSE Linux Enterprise Server 12 SP5 | apache-commons-httpclient | 3.1-6.3.1 |
| SUSE Linux Enterprise Server 15-LTSS | apache-commons-httpclient | 3.1-4.3.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | apache-commons-httpclient | 3.1-6.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | apache-commons-httpclient | 3.1-6.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | apache-commons-httpclient | 3.1-6.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | apache-commons-httpclient | 3.1-6.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 | apache-commons-httpclient | 3.1-4.3.2 |
| SUSE OpenStack Cloud 7 | apache-commons-httpclient | 3.1-6.3.1 |
| SUSE OpenStack Cloud 8 | apache-commons-httpclient | 3.1-6.3.1 |
| SUSE OpenStack Cloud 9 | apache-commons-httpclient | 3.1-6.3.1 |
| SUSE OpenStack Cloud Crowbar 8 | apache-commons-httpclient | 3.1-6.3.1 |
| SUSE OpenStack Cloud Crowbar 9 | apache-commons-httpclient | 3.1-6.3.1 |
| Ubuntu 14.04 LTS | commons-httpclient | 3.1-10.2ubuntu0.14.04.1 |
| Ubuntu 14.04 LTS | httpcomponents-client | 4.3.3-1ubuntu0.1 |
| openSUSE Leap 15.1 | apache-commons-httpclient | 3.1-lp151.4.3.1 |
| openSUSE Leap 15.2 | apache-commons-httpclient | 3.1-lp152.6.3.1 |
| openSUSE Tumbleweed | apache-commons-httpclient | 3.1-13.4 |