{"id":"CVE-2012-5783","aliases":["CLSA-2025-1751328213","DEBIAN-CVE-2012-5783","DLA-222-1","EUVD-2022-2129","GHSA-3832-9276-x7gf","MGASA-2013-0199","RHSA-2013:0270","RHSA-2013:0680","RHSA-2013:0682","RHSA-2014:0224","UBUNTU-CVE-2012-5783","USN-2769-1","openSUSE-SU-2024:10381-1"],"status":"published","title":"Improper Certificate Validation in Apache Commons HttpClient","description":"Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.","severity":{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.09254,"percentile":0.9539,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2012-11-04T00:00:00Z","modified":"2026-10-23T17:47:29Z","fixes":[{"ecosystem":"Maven","package":"commons-httpclient:commons-httpclient","fixed_in":["4.0"],"sources":["ghsa"]},{"ecosystem":"TuxCare:Maven","package":"commons-httpclient:commons-httpclient","fixed_in":["3.1.tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"commons-httpclient","fixed_in":["3.1-10.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"commons-httpclient","fixed_in":["3.1-10.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"commons-httpclient","fixed_in":["3.1-10.1"],"sources":["osv"]},{"ecosystem":"Mageia:2","package":"jakarta-commons-httpclient","fixed_in":["3.1-3.1.mga2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"jakarta-commons-httpclient","fixed_in":["1:3.0-7jpp.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"jakarta-commons-httpclient-debuginfo","fixed_in":["1:3.0-7jpp.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"jakarta-commons-httpclient-demo","fixed_in":["1:3.0-7jpp.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"jakarta-commons-httpclient-javadoc","fixed_in":["1:3.0-7jpp.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"jakarta-commons-httpclient-manual","fixed_in":["1:3.0-7jpp.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"jakarta-commons-httpclient","fixed_in":["1:3.1-0.7.el6_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"jakarta-commons-httpclient-debuginfo","fixed_in":["1:3.1-0.7.el6_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"jakarta-commons-httpclient-demo","fixed_in":["1:3.1-0.7.el6_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"jakarta-commons-httpclient-javadoc","fixed_in":["1:3.1-0.7.el6_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"jakarta-commons-httpclient-manual","fixed_in":["1:3.1-0.7.el6_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"jakarta-commons-httpclient","fixed_in":["1:3.1-0.7.el6_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"jakarta-commons-httpclient-debuginfo","fixed_in":["1:3.1-0.7.el6_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"jakarta-commons-httpclient-demo","fixed_in":["1:3.1-0.7.el6_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"jakarta-commons-httpclient-javadoc","fixed_in":["1:3.1-0.7.el6_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"jakarta-commons-httpclient-manual","fixed_in":["1:3.1-0.7.el6_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"jakarta-commons-httpclient","fixed_in":["1:3.1-0.7.el6_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"jakarta-commons-httpclient-debuginfo","fixed_in":["1:3.1-0.7.el6_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"jakarta-commons-httpclient-demo","fixed_in":["1:3.1-0.7.el6_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"jakarta-commons-httpclient-javadoc","fixed_in":["1:3.1-0.7.el6_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"jakarta-commons-httpclient-manual","fixed_in":["1:3.1-0.7.el6_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"jakarta-commons-httpclient","fixed_in":["1:3.1-0.7.el6_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"jakarta-commons-httpclient-debuginfo","fixed_in":["1:3.1-0.7.el6_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"jakarta-commons-httpclient-demo","fixed_in":["1:3.1-0.7.el6_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"jakarta-commons-httpclient-javadoc","fixed_in":["1:3.1-0.7.el6_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"jakarta-commons-httpclient-manual","fixed_in":["1:3.1-0.7.el6_3"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el4","package":"jakarta-commons-httpclient","fixed_in":["1:3.1-2.1_patch_01.ep5.el4"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"jakarta-commons-httpclient","fixed_in":["1:3.1-2.1_patch_01.ep5.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"jakarta-commons-httpclient","fixed_in":["1:3.1-2_patch_01.ep5.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el5","package":"jakarta-commons-httpclient","fixed_in":["1:3.1-2.1_patch_01.ep5.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el6","package":"jakarta-commons-httpclient","fixed_in":["1:3.1-2_patch_01.ep5.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:3","package":"redhat-support-plugin-rhev","fixed_in":["0:3.3.0-14.el6ev"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"apache-commons-httpclient","fixed_in":["3.1-8.5"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"commons-httpclient:commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"4.0"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"commons-httpclient:commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1"},{"fixed":"3.1.tuxcare.1"}]}],"versions":["3.1"]},{"source":"osv","ecosystem":"Debian:12","package":"commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-10.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-10.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-10.1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-9+deb6u1"}]}],"versions":["3.1-9"],"bundled":3},{"source":"osv","ecosystem":"Maven","package":"commons-httpclient:commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"}]}],"versions":["20020423","3.0","3.0.1","3.1","3.1-alpha1","3.1-beta1","3.1-jenkins-1","3.1-jenkins-2","3.1-jenkins-3","3.1-rc1"]},{"source":"osv","ecosystem":"Mageia:2","package":"jakarta-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-3.1.mga2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"jakarta-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0-7jpp.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"jakarta-commons-httpclient-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0-7jpp.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"jakarta-commons-httpclient-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0-7jpp.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"jakarta-commons-httpclient-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0-7jpp.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"jakarta-commons-httpclient-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0-7jpp.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"jakarta-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1-0.7.el6_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"jakarta-commons-httpclient-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1-0.7.el6_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"jakarta-commons-httpclient-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1-0.7.el6_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"jakarta-commons-httpclient-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1-0.7.el6_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"jakarta-commons-httpclient-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1-0.7.el6_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"jakarta-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1-0.7.el6_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"jakarta-commons-httpclient-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1-0.7.el6_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"jakarta-commons-httpclient-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1-0.7.el6_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"jakarta-commons-httpclient-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1-0.7.el6_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"jakarta-commons-httpclient-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1-0.7.el6_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"jakarta-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1-0.7.el6_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"jakarta-commons-httpclient-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1-0.7.el6_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"jakarta-commons-httpclient-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1-0.7.el6_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"jakarta-commons-httpclient-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1-0.7.el6_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"jakarta-commons-httpclient-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1-0.7.el6_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"jakarta-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1-0.7.el6_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"jakarta-commons-httpclient-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1-0.7.el6_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"jakarta-commons-httpclient-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1-0.7.el6_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"jakarta-commons-httpclient-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1-0.7.el6_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"jakarta-commons-httpclient-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1-0.7.el6_3"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el4","package":"jakarta-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1-2.1_patch_01.ep5.el4"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"jakarta-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1-2.1_patch_01.ep5.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"jakarta-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1-2_patch_01.ep5.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el5","package":"jakarta-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1-2.1_patch_01.ep5.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el6","package":"jakarta-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1-2_patch_01.ep5.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"redhat-support-plugin-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0-14.el6ev"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-10.2ubuntu0.14.04.1"}]}],"versions":["3.1-10.2"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"apache-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-8.5"}]}]}],"products":[{"vendor":"apache","product":"httpclient"},{"vendor":"canonical","product":"ubuntu_linux"}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2013-0681.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Broken Link","advisory"]},{"url":"https://issues.apache.org/jira/browse/HTTPCLIENT-1265","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Vendor Advisory","advisory","fix","report","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-04/msg00040.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Broken Link","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0680.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Broken Link","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2017:0868","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-02/msg00078.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Broken Link","web"]},{"url":"http://www.securityfocus.com/bid/58073","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/79984","tags":["vdb-entry","x_refsource_XF","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0270.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Broken Link","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0682.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Broken Link","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-04/msg00053.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Broken Link","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-04/msg00041.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Broken Link","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1853.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Broken Link","advisory","web"]},{"url":"http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf","tags":["x_refsource_MISC","x_transferred","Technical Description","Third Party Advisory","advisory","article","web","report"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0679.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Broken Link","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1147.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Broken Link","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2769-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0224.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Broken Link","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-5783","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3832-9276-x7gf"},{"url":"https://security-tracker.debian.org/tracker/CVE-2012-5783","tags":["advisory"]},{"url":"https://github.com/apache/httpcomponents-client","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2013-0199.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=8933","tags":["report"]},{"url":"https://rhn.redhat.com/errata/RHSA-2013-0270.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2013:0270","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=873317","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0270.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-5783","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-5783","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2013:0680","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0680.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2013:0682","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0682.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0224","tags":["advisory"]},{"url":"https://access.redhat.com/site/articles/425603","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0224.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2012-5783","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2769-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2012-6153","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-3577","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-5262","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5783","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2012-5783","description":"Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.","status":"published","published":"2012-11-04T22:00:00Z","modified":"2024-08-06T21:14:16.415Z","updated_at":"2026-11-02T14:34:49.600255Z"}],"euvd":[{"id":"EUVD-2022-2129","description":"Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.","status":"published","published":"2012-11-04T22:00:00Z","modified":"2024-08-06T21:14:16Z","updated_at":"2026-11-03T01:56:04.024018Z"}],"ghsa":[{"id":"GHSA-3832-9276-x7gf","title":"Improper Certificate Validation in Apache Commons HttpClient","description":"Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.\n\nNote that the Commons HttpClient project is [end of life](https://hc.apache.org/httpclient-legacy/). It has been replaced by the Apache HttpComponents project in its [HttpClient](https://hc.apache.org/httpcomponents-client-5.4.x/) and [HttpCore](https://hc.apache.org/httpcomponents-core-5.3.x/) modules. CVE-2012-5783 has been patched in [v4.0](https://repo1.maven.org/maven2/org/apache/httpcomponents/httpclient/4.0/) of the Apache HttpComponents HttpClient module.","status":"published","published":"2022-05-13T01:10:34Z","modified":"2024-11-05T22:28:06Z","cwes":["CWE-295"],"updated_at":"2026-11-02T14:38:16.477822Z"}],"nvd":[{"id":"CVE-2012-5783","description":"Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.","status":"published","published":"2012-11-04T22:55:03.297Z","modified":"2026-06-16T23:47:19.673Z","cvss":[{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:02:16.536025Z"}],"osv":[{"id":"RHSA-2013:0270","title":"Red Hat Security Advisory: jakarta-commons-httpclient security update","status":"published","published":"2024-09-13T08:00:54Z","modified":"2026-10-02T10:01:12Z","cvss":[{"version":"3.0","score":3.7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:53:01.495018Z"},{"id":"RHSA-2013:0680","title":"Red Hat Security Advisory: jakarta-commons-httpclient security update","status":"published","published":"2024-09-13T08:01:53Z","modified":"2026-10-02T10:01:13Z","cvss":[{"version":"3.0","score":3.7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"RHSA-2013:0682","title":"Red Hat Security Advisory: jakarta-commons-httpclient security update","status":"published","published":"2024-09-13T08:02:04Z","modified":"2026-10-02T10:01:13Z","cvss":[{"version":"3.0","score":3.7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"RHSA-2014:0224","title":"Red Hat Security Advisory: redhat-support-plugin-rhev security update","status":"published","published":"2024-09-13T08:02:35Z","modified":"2026-10-02T10:01:14Z","cvss":[{"version":"3.0","score":3.7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"CLSA-2025-1751328213","title":"TuxCare security update for commons-httpclient:commons-httpclient (1 CVE)","description":"TuxCare rebuilt commons-httpclient:commons-httpclient to address 1 CVE. Fixed in 3.1.tuxcare.1.","status":"published","published":"2026-08-04T14:52:04Z","modified":"2026-10-15T09:45:06.364064882Z","updated_at":"2026-11-02T15:43:41.66212Z"},{"id":"CVE-2012-5783","description":"Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.","status":"published","published":"2012-11-04T22:55:03Z","modified":"2026-04-16T06:15:51.532316434Z","updated_at":"2026-11-02T15:43:58.802805Z"},{"id":"DEBIAN-CVE-2012-5783","description":"Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.","status":"published","published":"2012-11-04T22:55:03.297Z","modified":"2026-10-23T17:47:29.38603446Z","updated_at":"2026-11-02T15:45:25.218101Z"},{"id":"DLA-222-1","title":"commons-httpclient - security update","status":"published","published":"2015-05-16T00:00:00Z","modified":"2026-03-09T01:19:25.566236Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"GHSA-3832-9276-x7gf","title":"Improper Certificate Validation in Apache Commons HttpClient","description":"Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.\n\nNote that the Commons HttpClient project is [end of life](https://hc.apache.org/httpclient-legacy/). It has been replaced by the Apache HttpComponents project in its [HttpClient](https://hc.apache.org/httpcomponents-client-5.4.x/) and [HttpCore](https://hc.apache.org/httpcomponents-core-5.3.x/) modules. CVE-2012-5783 has been patched in [v4.0](https://repo1.maven.org/maven2/org/apache/httpcomponents/httpclient/4.0/) of the Apache HttpComponents HttpClient module.","status":"published","published":"2022-05-13T01:10:34Z","modified":"2026-09-10T03:49:07.300846048Z","cwes":["CWE-295"],"updated_at":"2026-11-02T15:46:35.406455Z"},{"id":"MGASA-2013-0199","title":"Updated jakarta-commons-httpclient package fixes security vulnerability","description":"The Jakarta Commons HttpClient component did not verify that the server\nhostname matched the domain name in the subject's Common Name (CN) or\nsubjectAltName field in X.509 certificates. This could allow a\nman-in-the-middle attacker to spoof an SSL server if they had a certificate\nthat was valid for any domain name (CVE-2012-5783).\n","status":"published","published":"2013-07-06T14:11:31Z","modified":"2026-04-16T06:24:05.779060204Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2024:10381-1","title":"apache-commons-httpclient-3.1-8.5 on GA media","description":"These are all security issues fixed in the apache-commons-httpclient-3.1-8.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:43:32.837988Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"UBUNTU-CVE-2012-5783","description":"Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.","status":"withdrawn","published":"2012-11-04T00:00:00Z","modified":"2026-02-04T02:36:28.989046Z","updated_at":"2026-11-02T15:54:06.854805Z"},{"id":"USN-2769-1","title":"commons-httpclient vulnerabilities","description":"It was discovered that Apache Commons HttpClient did not properly verify the\nCommon Name or subjectAltName fields of X.509 certificates. An attacker could\nexploit this to perform a machine-in-the-middle attack to view sensitive\ninformation or alter encrypted communications. This issue only affected Ubuntu\n12.04 LTS. (CVE-2012-5783)\n\nFlorian Weimer discovered the fix for CVE-2012-5783 was incomplete for Apache\nCommons HttpClient. An attacker could exploit this to perform a\nmachine-in-the-middle attack to view sensitive information or alter\nencrypted communications. This issue only affected Ubuntu 12.04 LTS.\n(CVE-2012-6153)\n\nSubodh Iyengar and Will Shackleton discovered the fix for CVE-2012-5783 was\nincomplete for Apache Commons HttpClient. An attacker could exploit this to\nperform a machine-in-the-middle attack to view sensitive information or alter\nencrypted communications. (CVE-2014-3577)\n\nIt was discovered that Apache Commons HttpClient did not properly handle read\ntimeouts during HTTPS handshakes. A remote attacker could trigger this flaw to\ncause a denial of service. (CVE-2015-5262)\n","status":"published","published":"2015-10-14T15:43:52Z","modified":"2026-02-10T04:40:55Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}