CVE-2012-5783
It was found that Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Find out more about CVE-2012-5783 from the MITRE CVE dictionary dictionary and NIST NVD.
CVSS v2 metrics
| Base Score | 4.3 |
|---|---|
| Base Metrics | AV:N/AC:M/Au:N/C:N/I:P/A:N |
| Access Vector | Network |
| Access Complexity | Medium |
| Authentication | None |
| Confidentiality Impact | None |
| Integrity Impact | Partial |
| Availability Impact | None |
CVSS v3 metrics
| CVSS3 Base Score | 3.7 |
|---|---|
| CVSS3 Base Metrics | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N |
| Attack Vector | Network |
| Attack Complexity | High |
| Privileges Required | None |
| User Interaction | None |
| Scope | Unchanged |
| Confidentiality | None |
| Integrity Impact | Low |
| Availability Impact | None |
Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).
Red Hat Security Errata
| Platform | Errata | Release Date |
|---|---|---|
| Red Hat JBoss Web Platform 5.2 | RHSA-2013:0681 | 2013-03-25 |
| Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS (jakarta-commons-httpclient) | RHSA-2013:0680 | 2013-03-25 |
| Red Hat Enterprise Linux 5 (jakarta-commons-httpclient) | RHSA-2013:0270 | 2013-02-19 |
| Red Hat JBoss SOA Platform 5.3 | RHSA-2013:1147 | 2013-08-08 |
| RHEV Manager 3 (redhat-support-plugin-rhev) | RHSA-2014:0224 | 2014-02-27 |
| Red Hat JBoss Web Platform 5 for RHEL 5 Server (jakarta-commons-httpclient) | RHSA-2013:0682 | 2013-03-25 |
| Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server (jakarta-commons-httpclient) | RHSA-2013:0680 | 2013-03-25 |
| Red Hat JBoss Web Platform 5 for RHEL 6 Server (jakarta-commons-httpclient) | RHSA-2013:0682 | 2013-03-25 |
| Red Hat JBoss Fuse 6.3 | RHSA-2017:0868 | 2017-04-03 |
| Red Hat JBoss A-MQ 6.3 | RHSA-2017:0868 | 2017-04-03 |
| Red Hat JBoss Web Platform 5 for RHEL 4 AS (jakarta-commons-httpclient) | RHSA-2013:0682 | 2013-03-25 |
| Red Hat JBoss Web Framework Kit 2.2 | RHSA-2013:0763 | 2013-04-22 |
| Red Hat JBoss Operations Network 3.2 | RHSA-2013:1853 | 2013-12-17 |
| Red Hat JBoss Enterprise Application Platform 5.2 | RHSA-2013:0679 | 2013-03-25 |
| Red Hat Enterprise Linux 6 (jakarta-commons-httpclient) | RHSA-2013:0270 | 2013-02-19 |
| Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server (jakarta-commons-httpclient) | RHSA-2013:0680 | 2013-03-25 |
| JBoss Enterprise BRMS Platform 5.3 | RHSA-2013:1006 | 2013-07-01 |
Affected Packages State
| Platform | Package | State |
|---|---|---|
| Red Hat Subscription Asset Manager 1 | candlepin | Not affected |
| Red Hat Satellite 5.3 | jakarta-commons-httpclient | Will not fix |
| Red Hat Satellite 5.2 | jakarta-commons-httpclient | Will not fix |
| Red Hat Satellite 5.1 | jakarta-commons-httpclient | Will not fix |
| Red Hat Satellite 5.0 | jakarta-commons-httpclient | Will not fix |
| Red Hat JBoss Portal Platform 4 | jakarta-commons-httpclient | Will not fix |
| Red Hat JBoss Portal 5 | jakarta-commons-httpclient | Will not fix |
| Red Hat JBoss Operations Network 3.1 | jakarta-commons-httpclient | Will not fix |
| Red Hat JBoss Enterprise SOA Platform 4.3 | jakarta-commons-httpclient | Will not fix |
| Red Hat JBoss Enterprise SOA Platform 4.2 | jakarta-commons-httpclient | Will not fix |
| Red Hat JBoss EWS 1 | jakarta-commons-httpclient | Will not fix |