RHSA-2013:0679: Moderate: jakarta-commons-httpclient security update
The Jakarta Commons HttpClient component can be used to build HTTP-awareclient applications (such as web browsers and web service clients).The Jakarta Commons HttpClient component did not verify that the serverhostname matched the domain name in the subject's Common Name (CN) orsubjectAltName field in X.509 certificates. This could allow aman-in-the-middle attacker to spoof an SSL server if they had a certificatethat was valid for any domain name. (CVE-2012-5783)Warning: Before applying this update, back up your existing JBossEnterprise Application Platform installation (including all applicationsand configuration files).All users of JBoss Enterprise Application Platform 5.2.0 as provided fromthe Red Hat Customer Portal are advised to apply this update.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2013:0679?
The severity of RHSA-2013:0679 is classified as moderate.
How do I fix RHSA-2013:0679?
To fix RHSA-2013:0679, you should update the Jakarta Commons HttpClient component to the latest version that addresses the vulnerability.
What vulnerability does RHSA-2013:0679 address?
RHSA-2013:0679 addresses a vulnerability in the Jakarta Commons HttpClient that fails to verify the server hostname against the domain name in the certificate.
Who is affected by RHSA-2013:0679?
Individuals and organizations using affected versions of the Jakarta Commons HttpClient component may be vulnerable to this issue.
What are the potential risks of RHSA-2013:0679?
The potential risks of RHSA-2013:0679 include exposure to man-in-the-middle attacks due to improper SSL/TLS hostname verification.