GHSA-pqwh-44jj-p5rm

ghsaUSosv

Hostname verification in Apache HttpClient 4.3 was disabled by default

view advisory published 2022-05-13Licence: CC-BY-4.0

http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509HostnameVerifier is not null, which allows attackers to have unspecified impact via vectors involving hostname verification.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2013-4366US	critical9.8	3.31% (89th)	—	2017-10-30
http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509HostnameVerifier is not null, which allows attackers to have unspecified im…

references

External citations — patches, advisories, analysis.

http://svn.apache.org/r1528614WEB
http://www.apache.org/dist/httpcomponents/httpclient/RELEASE_NOTES-4.3.x.txtWEB
https://github.com/apache/httpcomponents-client/commit/08140864e3e4c0994e094c4cf0507932baf6a66WEB
https://nvd.nist.gov/vuln/detail/CVE-2013-4366ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan