CVE-2014-3577
- State
- Published
- Severity
- Not scored
- Published
- Aug 21, 2014
- Updated
- Aug 6, 2024
- Reserved
- May 14, 2014
Description
org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- RHSA-2014:1891vendor-advisory
- RHSA-2015:0765vendor-advisory
- https://access.redhat.com/solutions/1165533
- 110143vdb-entry
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- RHSA-2015:0675vendor-advisory
- 60713third-party-advisory
- http://packetstormsecurity.com/files/127913/Apache-HttpComponents-Man-In-The-Middle.html
- RHSA-2015:0720vendor-advisory
- RHSA-2014:1166vendor-advisory
- RHSA-2015:1888vendor-advisory
- RHSA-2014:1833vendor-advisory
- RHSA-2015:0850vendor-advisory
- RHSA-2015:0158vendor-advisory
- RHSA-2014:1834vendor-advisory
- 60466third-party-advisory
- RHSA-2015:0125vendor-advisory
- RHSA-2015:1176vendor-advisory
- RHSA-2016:1931vendor-advisory
- RHSA-2014:1146vendor-advisory
- RHSA-2015:1177vendor-advisory
- 69258vdb-entry
- RHSA-2014:1892vendor-advisory
- RHSA-2015:0851vendor-advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05103564
- RHSA-2014:1835vendor-advisory
- 1030812vdb-entry
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05363782
- USN-2769-1vendor-advisory
- 60589third-party-advisory
- RHSA-2014:1836vendor-advisory
- apache-cve20143577-spoofing(95327)vdb-entry
- 20140818 CVE-2014-3577: Apache HttpComponents client: Hostname verification susceptible to MITM attackmailing-list
- RHSA-2016:1773vendor-advisory
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilitiesmailing-list
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilitiesmailing-list
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilitiesmailing-list
- [cxf-commits] 20200116 svn commit: r1055336 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-12423.txt.asc security-advisories.data/CVE-2019-17573.txt.asc security-advisories.htmlmailing-list
- [cxf-commits] 20200319 svn commit: r1058035 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-17573.txt.asc security-advisories.htmlmailing-list
- [cxf-commits] 20200401 svn commit: r1058573 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2020-1954.txt.asc security-advisories.htmlmailing-list
- openSUSE-SU-2020:1873vendor-advisory
- openSUSE-SU-2020:1875vendor-advisory
- [cxf-commits] 20201112 svn commit: r1067927 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2020-13954.txt.asc security-advisories.htmlmailing-list
- [cxf-commits] 20210402 svn commit: r1073270 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2021-22696.txt.asc security-advisories.htmlmailing-list
- [cxf-commits] 20210616 svn commit: r1075801 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2021-30468.txt.asc security-advisories.htmlmailing-list
- [oss-security] 20211006 Multiple vulnerabilities in Jenkins and Jenkins pluginsmailing-list
- https://security.netapp.com/advisory/ntap-20231027-0003/
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.