CVE-2012-6153

描述

http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5783.

如何修補 CVE-2012-6153

要修補 CVE-2012-6153,請將受影響套件升級到下列已修補版本。

• —升級至 3.1-10.2 或更新版本
• —升級至 4.2.3 或更新版本

CVE-2012-6153 正在被利用嗎?

中等 — EPSS 為 5.8%,可持續追蹤但非最高優先。

受影響套件(2)

• from 0, < 3.1-10.2
• from 0, < 4.2.3

參考連結(25)

• ADVISORYgithub.com/advisories/GHSA-2x83-r56g-cv47
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2012-6153
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2012-6153
• WEBrhn.redhat.com/errata/RHSA-2014-1098.html
• WEB