CVE-2012-6153: Input Validation
http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5783.
Other sources
It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject's Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.
It was found that the fix for CVE-2012-5783 was incomplete. The code added to check that the server hostname matches the domain name in the subject's CN field was flawed. This can be exploited by a Man-in-the-middle (MITM) attack, where the attacker can spoof a valid certificate using a specially crafted subject.
— Red Hat
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
- RHSA-2014:1320
- RHSA-2014:1833
- RHSA-2014:1098
- RHSA-2014:1892
- RHSA-2015:0234
- RHSA-2015:0851
- RHSA-2014:1891
- RHSA-2015:0235
- RHSA-2015:0850
- RHSA-2015:0765
- RHSA-2015:0675
- RHSA-2014:1323
- RHSA-2014:1836
- RHSA-2014:1321
- RHSA-2014:1834
- RHSA-2014:1163
- RHSA-2014:2020
- RHSA-2014:1162
- RHSA-2014:2019
- RHSA-2015:0720
- RHSA-2014:1904
- RHSA-2015:1009
- RHSA-2015:1888
- RHSA-2015:0125
- RHSA-2014:1322
- RHSA-2014:1835
- RHSA-2015:0158
- IBM-7262513
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2012-6153.
What is the severity of CVE-2012-6153?
The severity of CVE-2012-6153 is high with a score of 4.3.
What is the affected software?
The affected software includes jakarta-commons-httpclient, jboss-seam2, apache-cxf, devtoolset, httpcomponents-client, Apache Commons-httpclient, IBM ISAM, and IBM Security Verify Access.
What is the fix for CVE-2012-6153?
There is no specific fix mentioned in the provided information, but it is recommended to update to the latest version of the affected software.
Where can I find more information about CVE-2012-6153?
You can find more information about CVE-2012-6153 on CVE website (https://www.cve.org/CVERecord?id=CVE-2012-6153) and NVD website (https://nvd.nist.gov/vuln/detail/CVE-2012-6153).