CVE-2014-3577: Medium severity Apache HttpClient vulnerability
It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject's Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.
Other sources
It was found that the fix for CVE-2012-6153 was incomplete. The code added to check that the server hostname matches the domain name in the subject's CN field was flawed. This can be exploited by a Man-in-the-middle (MITM) attack where the attacker can spoof a valid certificate using a specially crafted subject.
— Red Hat
org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=
— IBM
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
- RHSA-2014:1320
- RHSA-2014:1833
- RHSA-2014:1166
- RHSA-2014:1146
- RHSA-2016:1931
- RHSA-2015:1177
- RHSA-2014:1892
- RHSA-2015:0234
- RHSA-2015:0851
- RHSA-2014:1891
- RHSA-2015:0235
- RHSA-2015:0850
- RHSA-2015:0765
- RHSA-2015:0675
- RHSA-2014:1323
- RHSA-2014:1836
- RHSA-2014:1321
- RHSA-2014:1834
- RHSA-2014:1163
- RHSA-2014:2020
- RHSA-2014:1162
- RHSA-2014:2019
- RHSA-2015:1176
- RHSA-2015:0720
- RHSA-2014:1904
- RHSA-2015:1009
- RHSA-2015:1888
- RHSA-2015:0125
- RHSA-2014:1322
- RHSA-2014:1835
- RHSA-2022:0055
- RHSA-2016:1773
- RHSA-2014:1082
- RHSA-2015:0158
- IBM-7262513
Frequently Asked Questions
What is the severity of CVE-2014-3577?
The severity of CVE-2014-3577 is classified as medium due to the potential for man-in-the-middle attacks.
How do I fix CVE-2014-3577?
To fix CVE-2014-3577, you should upgrade to Apache HttpClient version 4.3.5 or higher.
Which versions are affected by CVE-2014-3577?
Versions of Apache HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 are affected by CVE-2014-3577.
What is the impact of CVE-2014-3577?
CVE-2014-3577 allows attackers to perform man-in-the-middle attacks due to improper hostname verification.
Is CVE-2014-3577 exploitable remotely?
Yes, CVE-2014-3577 is exploitable remotely as it involves network communications that can be intercepted.