RHSA-2014:1098: Important: devtoolset-2-httpcomponents-client security update
HttpClient is an HTTP/1.1 compliant HTTP agent implementation based onhttpcomponents HttpCore.It was discovered that the HttpClient incorrectly extracted host name froman X.509 certificate subject's Common Name (CN) field. A man-in-the-middleattacker could use this flaw to spoof an SSL server using a speciallycrafted X.509 certificate. (CVE-2012-6153)This issue was discovered by Florian Weimer of Red Hat Product Security.For additional information on this flaw, refer to the Knowledgebase articlein the References section.All devtoolset-2-httpcomponents-client users are advised to upgrade tothese updated packages, which contain a backported patch to correct thisissue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2014:1098?
The severity of RHSA-2014:1098 is classified as important.
How do I fix RHSA-2014:1098?
To fix RHSA-2014:1098, upgrade to the package 2-httpcomponents-client-4.2.1-6.el6 or later.
Which software is affected by RHSA-2014:1098?
RHSA-2014:1098 affects the devtoolset packages, specifically the HTTP components client.
What type of vulnerability is described in RHSA-2014:1098?
RHSA-2014:1098 describes a vulnerability where HttpClient could incorrectly extract the host name from an X.509 certificate.
Can a man-in-the-middle attack occur due to RHSA-2014:1098?
Yes, a man-in-the-middle attacker could exploit the vulnerability described in RHSA-2014:1098.