CVE-2015-5262
Fixed in a distro release EPSS 19%
http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.
Products: canonical ubuntu_linux, fedoraproject fedora, apache httpclient
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.httpcomponents:httpclient | 4.3.6 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | eco-java-gradle-1.11 | no fix |
| Chainguard | eco-java-gradle-2.0 | no fix |
| Chainguard | eco-java-gradle-2.1 | no fix |
| Chainguard | eco-java-gradle-2.10 | no fix |
| Chainguard | eco-java-gradle-2.2 | no fix |
| Chainguard | eco-java-gradle-2.2.1 | no fix |
| Chainguard | eco-java-gradle-2.3 | no fix |
| Chainguard | eco-java-gradle-2.4 | no fix |
| Chainguard | eco-java-gradle-2.5 | no fix |
| Chainguard | eco-java-gradle-2.6 | no fix |
| Chainguard | eco-java-gradle-2.7 | no fix |
| Chainguard | eco-java-gradle-2.8 | no fix |
| Chainguard | eco-java-gradle-2.9 | no fix |
| Chainguard | hadoop-fips-3.3.6 | no fix |
| Chainguard | hadoop-fips-3.4.2 | no fix |
| Chainguard | hadoop-fips-3.5 | no fix |
| Debian 12 | commons-httpclient | 3.1-12 |
| Debian 12 | httpcomponents-client | 4.3.6-1 |
| Debian 13 | commons-httpclient | 3.1-12 |
| Debian 13 | httpcomponents-client | 4.3.6-1 |
| Debian 14 | commons-httpclient | 3.1-12 |
| Debian 14 | httpcomponents-client | 4.3.6-1 |
| Debian 6.0 | commons-httpclient | 3.1-9+deb6u2 |
| SUSE Enterprise Storage 5 | apache-commons-httpclient | 3.1-6.3.1 |
| SUSE HPE Helion OpenStack 8 | apache-commons-httpclient | 3.1-6.3.1 |
| SUSE Linux Enterprise High Performance Computing 15-ESPOS | apache-commons-httpclient | 3.1-4.3.2 |
| SUSE Linux Enterprise High Performance Computing 15-LTSS | apache-commons-httpclient | 3.1-4.3.2 |
| SUSE Linux Enterprise Module for Basesystem 15 SP1 | apache-commons-httpclient | 3.1-4.3.2 |
| SUSE Linux Enterprise Module for Basesystem 15 SP2 | apache-commons-httpclient | 3.1-11.3.2 |
| SUSE Linux Enterprise Server 12 SP2-BCL | apache-commons-httpclient | 3.1-6.3.1 |
| SUSE Linux Enterprise Server 12 SP2-LTSS | apache-commons-httpclient | 3.1-6.3.1 |
| SUSE Linux Enterprise Server 12 SP3-BCL | apache-commons-httpclient | 3.1-6.3.1 |
| SUSE Linux Enterprise Server 12 SP3-LTSS | apache-commons-httpclient | 3.1-6.3.1 |
| SUSE Linux Enterprise Server 12 SP4-LTSS | apache-commons-httpclient | 3.1-6.3.1 |
| SUSE Linux Enterprise Server 12 SP5 | apache-commons-httpclient | 3.1-6.3.1 |
| SUSE Linux Enterprise Server 15-LTSS | apache-commons-httpclient | 3.1-4.3.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | apache-commons-httpclient | 3.1-6.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | apache-commons-httpclient | 3.1-6.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | apache-commons-httpclient | 3.1-6.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | apache-commons-httpclient | 3.1-6.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 | apache-commons-httpclient | 3.1-4.3.2 |
| SUSE OpenStack Cloud 7 | apache-commons-httpclient | 3.1-6.3.1 |
| SUSE OpenStack Cloud 8 | apache-commons-httpclient | 3.1-6.3.1 |
| SUSE OpenStack Cloud 9 | apache-commons-httpclient | 3.1-6.3.1 |
| SUSE OpenStack Cloud Crowbar 8 | apache-commons-httpclient | 3.1-6.3.1 |
| SUSE OpenStack Cloud Crowbar 9 | apache-commons-httpclient | 3.1-6.3.1 |
| Ubuntu 14.04 LTS | commons-httpclient | 3.1-10.2ubuntu0.14.04.1 |
| Ubuntu 16.04 LTS | commons-httpclient | 3.1-11ubuntu1 |
| Ubuntu Pro 14.04 LTS | httpcomponents-client | 4.3.3-1ubuntu0.1+esm1 |
| openSUSE Leap 15.1 | apache-commons-httpclient | 3.1-lp151.4.3.1 |
| openSUSE Leap 15.2 | apache-commons-httpclient | 3.1-lp152.6.3.1 |
| openSUSE Tumbleweed | apache-commons-httpclient | 3.1-13.4 |