GHSA-pqwh-44jj-p5rm

ghsaUSosv

Hostname verification in Apache HttpClient 4.3 was disabled by default

Advisory ansehen veröffentlicht 2022-05-13Lizenz: CC-BY-4.0

http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509HostnameVerifier is not null, which allows attackers to have unspecified impact via vectors involving hostname verification.

beschreibt (1)

Zugehörige CVEs.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2013-4366US	critical9.8	3.31% (89th)	—	2017-10-30
http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509HostnameVerifier is not null, which allows attackers to have unspecified im…

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

http://svn.apache.org/r1528614WEB
http://www.apache.org/dist/httpcomponents/httpclient/RELEASE_NOTES-4.3.x.txtWEB
https://github.com/apache/httpcomponents-client/commit/08140864e3e4c0994e094c4cf0507932baf6a66WEB
https://nvd.nist.gov/vuln/detail/CVE-2013-4366ADVISORY

scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan