RHSA-2013:0270: Moderate: jakarta-commons-httpclient security update
The Jakarta Commons HttpClient component can be used to build HTTP-awareclient applications (such as web browsers and web service clients).The Jakarta Commons HttpClient component did not verify that the serverhostname matched the domain name in the subject's Common Name (CN) orsubjectAltName field in X.509 certificates. This could allow aman-in-the-middle attacker to spoof an SSL server if they had a certificatethat was valid for any domain name. (CVE-2012-5783)All users of jakarta-commons-httpclient are advised to upgrade to theseupdated packages, which correct this issue. Applications using the JakartaCommons HttpClient component must be restarted for this update to takeeffect.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2013:0270?
The severity of RHSA-2013:0270 is classified as moderate.
How do I fix RHSA-2013:0270?
To fix RHSA-2013:0270, update the jakarta-commons-httpclient package to version 3.1-0.7.el6_3.
What vulnerabilities are associated with RHSA-2013:0270?
RHSA-2013:0270 is associated with a vulnerability in the Jakarta Commons HttpClient related to hostname verification.
Which versions of jakarta-commons-httpclient are affected by RHSA-2013:0270?
Versions of jakarta-commons-httpclient up to 3.1-0.7.el6_3 are affected by RHSA-2013:0270.
Is RHSA-2013:0270 applicable to all Red Hat users?
RHSA-2013:0270 applies to Red Hat users utilizing the affected versions of jakarta-commons-httpclient on their systems.