CVE-2013-7398
mediumpriority · track · 17OT risk · elevatedEPSS 0.008 · 57 %ileEUUSEPSS · scored 2026-10-27
main/java/com/ning/http/client/AsyncHttpClientConfig.java in Async Http Client (aka AHC or async-http-client) before 1.9.0 does not require a hostname match during verification of X.509 certificates, which allows man-in-the-middle attackers to spoof HTTPS servers via an arbitrary valid certificate.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedRed Hat JBoss Fuse Service Works 6.0redhat_csaf
The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Fuse Service Works installation (including its databases, applications, configuration files, and so on). Note that it is recommended to halt the Red Hat JBoss Fuse Service Works server by stopping the JBoss Application Server process before installing this update, and then after installing the update, restart the Red Hat JBoss Fuse Service Works server by starting the JBoss Application Server process.
https://access.redhat.com/errata/RHSA-2015:1551
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 3.7–5.8
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (5)
Products and version ranges known to be affected.
- async-http-client project async-http-client≤ 1.9.0nvdUScpe:2.3:a:async-http-client_project:async-http-client:*:*:*:*:*:*:*:*
- Red Hat JBoss Fuse Service Works 6.0all versionsfixedredhat_csafUScpe:/a:redhat:jboss_fuse_service_works:6.0
advisories (2)
Vendor and ecosystem advisories describing this.
- RHSA-2015:1551Red Hat Security Advisory: Red Hat JBoss Fuse Service Works 6.0.0 security update2015-08-05csaf · redhat_csafUS
Red Hat JBoss Fuse Service Works 6.0.0 roll up patch 5, which fixes two security issues and various bugs, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
- GHSA-5c66-6h6g-6q6mInsufficient Verification of Data Authenticity in Async Http Client2022-05-13ghsa · osvUS
main/java/com/ning/http/client/AsyncHttpClientConfig.java in Async Http Client (aka AHC or async-http-client) before 1.9.0 does not require a hostname match during verification of X.509 certificates, which allows man-in-the-middle attackers to spoof HTTPS servers via an arbitrary valid certificate.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (32)
External citations — patches, advisories, analysis.
- http://openwall.com/lists/oss-security/2014/08/26/1cnnvd
- http://rhn.redhat.com/errata/RHSA-2015-0850.htmlcnnvd
- http://rhn.redhat.com/errata/RHSA-2015-0851.htmlcnnvd
- http://rhn.redhat.com/errata/RHSA-2015-1176.htmlcnnvd
- http://rhn.redhat.com/errata/RHSA-2015-1551.htmlcnnvd
- http://www.securityfocus.com/bid/69317cnnvd
- https://github.com/AsyncHttpClient/async-cnnvd
- https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-1.9.0Patchcnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan