{"id":"CVE-2012-5784","aliases":["DEBIAN-CVE-2012-5784","DLA-169-1","EUVD-2020-1408","GHSA-55w9-c3g2-4rrh","MGASA-2013-0200","RHSA-2013:0269","RHSA-2013:0683","RHSA-2014:0037","RHSA-2014:1123","SUSE-SU-2019:1373-1","SUSE-SU-2019:1373-2","SUSE-SU-2019:1382-1","openSUSE-SU-2019:1497-1","openSUSE-SU-2024:10646-1"],"status":"published","title":"Man-in-the-middle attack in Apache Axis","description":"Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.","severity":{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.05722,"percentile":0.9309,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2012-11-04T22:00:00Z","modified":"2026-10-23T17:47:36Z","fixes":[{"ecosystem":"Debian:12","package":"axis","fixed_in":["1.4-16.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"axis","fixed_in":["1.4-16.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"axis","fixed_in":["1.4-16.1"],"sources":["osv"]},{"ecosystem":"Mageia:2","package":"axis","fixed_in":["1.4-6.1.mga2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"axis","fixed_in":["0:1.2.1-7.3.el6_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"axis-javadoc","fixed_in":["0:1.2.1-7.3.el6_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"axis-manual","fixed_in":["0:1.2.1-7.3.el6_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"axis","fixed_in":["0:1.2.1-7.3.el6_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"axis-javadoc","fixed_in":["0:1.2.1-7.3.el6_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"axis-manual","fixed_in":["0:1.2.1-7.3.el6_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"axis","fixed_in":["0:1.2.1-7.3.el6_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"axis-javadoc","fixed_in":["0:1.2.1-7.3.el6_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"axis-manual","fixed_in":["0:1.2.1-7.3.el6_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"axis","fixed_in":["0:1.2.1-7.3.el6_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"axis-javadoc","fixed_in":["0:1.2.1-7.3.el6_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"axis-manual","fixed_in":["0:1.2.1-7.3.el6_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"axis","fixed_in":["0:1.2.1-2jpp.7.el5_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"axis-debuginfo","fixed_in":["0:1.2.1-2jpp.7.el5_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"axis-javadoc","fixed_in":["0:1.2.1-2jpp.7.el5_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"axis-manual","fixed_in":["0:1.2.1-2jpp.7.el5_9"],"sources":["osv"]},{"ecosystem":"Red Hat:developer_toolset:2.1::el6","package":"devtoolset-2-axis","fixed_in":["0:1.4-23.el6"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.axis:axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.4"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"axis:axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-16.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-16.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-16.1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-12+deb6u1"}]}],"versions":["1.4-12"],"bundled":2},{"source":"osv","ecosystem":"Maven","package":"org.apache.axis:axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.4"}]}],"versions":["1.4"]},{"source":"osv","ecosystem":"Maven","package":"axis:axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.4"}]}],"versions":["1.0","1.1","1.1-beta","1.2","1.2-RC1","1.2-RC2","1.2-RC3","1.2-alpha-1","1.2-beta-2","1.2-beta-3","1.2.1","1.3","1.4"]},{"source":"osv","ecosystem":"Mageia:2","package":"axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-6.1.mga2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-7.3.el6_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"axis-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-7.3.el6_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"axis-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-7.3.el6_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-7.3.el6_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"axis-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-7.3.el6_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"axis-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-7.3.el6_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-7.3.el6_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"axis-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-7.3.el6_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"axis-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-7.3.el6_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-7.3.el6_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"axis-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-7.3.el6_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"axis-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-7.3.el6_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-2jpp.7.el5_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"axis-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-2jpp.7.el5_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"axis-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-2jpp.7.el5_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"axis-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-2jpp.7.el5_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"jasperreports-server-pro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.0-4.el6ev"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:developer_toolset:2.1::el6","package":"devtoolset-2-axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4-23.el6"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-5.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-5.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-290.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-290.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-290.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-290.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-lp150.9.1"}]}],"bundled":2}],"products":[{"vendor":"apache","product":"activemq"},{"vendor":"apache","product":"axis"},{"vendor":"paypal","product":"mass_pay"},{"vendor":"paypal","product":"payments_pro"},{"vendor":"paypal","product":"transactional_information_soap"}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2013-0269.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0037.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://secunia.com/advisories/51219","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0683.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.securityfocus.com/bid/56408","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/79829","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf","tags":["x_refsource_MISC","x_transferred","Exploit","Technical Description","article","evidence","web"]},{"url":"https://lists.apache.org/thread.html/44d4e88a5fa8ae60deb752029afe9054da87c5f859caf296fcf585e5%40%3Cjava-dev.axis.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/de2af12dcaba653d02b03235327ca4aa930401813a3cced8e151d29c%40%3Cjava-dev.axis.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00007.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00022.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/8aa25c99eeb0693fc229ec87d1423b5ed5d58558618706d8aba1d832%40%3Cjava-dev.axis.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/a308887782e05da7cf692e4851ae2bd429a038570cbf594e6631cc8d%40%3Cjava-dev.axis.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/5e6c92145deddcecf70c3604041dcbd615efa2d37632fc2b9c367780%40%3Cjava-dev.axis.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-5784","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/44d4e88a5fa8ae60deb752029afe9054da87c5f859caf296fcf585e5@%3Cjava-dev.axis.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/5e6c92145deddcecf70c3604041dcbd615efa2d37632fc2b9c367780@%3Cjava-dev.axis.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/8aa25c99eeb0693fc229ec87d1423b5ed5d58558618706d8aba1d832@%3Cjava-dev.axis.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/a308887782e05da7cf692e4851ae2bd429a038570cbf594e6631cc8d@%3Cjava-dev.axis.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/de2af12dcaba653d02b03235327ca4aa930401813a3cced8e151d29c@%3Cjava-dev.axis.apache.org%3E","tags":["web"]},{"url":"https://github.com/advisories/GHSA-55w9-c3g2-4rrh"},{"url":"https://security-tracker.debian.org/tracker/CVE-2012-5784","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2013-0200.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=8936","tags":["report"]},{"url":"https://rhn.redhat.com/errata/RHSA-2013-0269.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2013:0269","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=873252","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0269.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-5784","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-5784","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2013:0683","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0683.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0037","tags":["advisory"]},{"url":"https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Virtualization/3.3/html/Technical_Notes/chap-RHSA-20140037_-_jasperreports.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=967349","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=977642","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=988210","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1001326","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1020340","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1033090","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0037.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-2192","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-2192","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2192","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2014:1123","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1123.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191373-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1134598","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3596","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191373-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191382-1/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NIAMULYG5N26EYEDOKOQ7IOJ2QNZHEZV/#NIAMULYG5N26EYEDOKOQ7IOJ2QNZHEZV","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8032","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2012-5784","description":"Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.","status":"published","published":"2012-11-04T22:00:00Z","modified":"2024-08-06T21:14:16.399Z","updated_at":"2026-11-02T14:34:49.600255Z"}],"euvd":[{"id":"EUVD-2020-1408","description":"Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.","status":"published","published":"2012-11-04T22:00:00Z","modified":"2024-08-06T21:14:16Z","updated_at":"2026-11-03T01:56:04.024018Z"}],"ghsa":[{"id":"GHSA-55w9-c3g2-4rrh","title":"Man-in-the-middle attack in Apache Axis","description":"Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.","status":"published","published":"2020-10-07T17:51:02Z","modified":"2023-01-09T05:04:27Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:36:10.502376Z"}],"nvd":[{"id":"CVE-2012-5784","description":"Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.","status":"published","published":"2012-11-04T22:55:03.327Z","modified":"2026-06-16T23:47:19.857Z","cvss":[{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:16.536025Z"}],"osv":[{"id":"CVE-2012-5784","description":"Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.","status":"published","published":"2012-11-04T22:55:03Z","modified":"2026-04-16T06:19:24.318206708Z","updated_at":"2026-11-02T15:43:58.802805Z"},{"id":"DEBIAN-CVE-2012-5784","description":"Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.","status":"published","published":"2012-11-04T22:55:03.327Z","modified":"2026-10-23T17:47:36.552012698Z","updated_at":"2026-11-02T15:45:25.218101Z"},{"id":"DLA-169-1","title":"axis - security update","status":"published","published":"2015-03-10T00:00:00Z","modified":"2026-03-09T01:22:30.795387Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"GHSA-55w9-c3g2-4rrh","title":"Man-in-the-middle attack in Apache Axis","description":"Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.","status":"published","published":"2020-10-07T17:51:02Z","modified":"2024-12-02T05:41:04.511974Z","cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:37.864461Z"},{"id":"MGASA-2013-0200","title":"Updated axis package fixes security vulnerability","description":"Apache Axis did not verify that the server hostname matched the domain name\nin the subject's Common Name (CN) or subjectAltName field in X.509\ncertificates. This could allow a man-in-the-middle attacker to spoof an SSL\nserver if they had a certificate that was valid for any domain name\n(CVE-2012-5784).\n","status":"published","published":"2013-07-06T14:12:34Z","modified":"2026-04-16T06:23:12.130697262Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2019:1497-1","title":"Security update for axis","description":"This update for axis fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2012-5784, CVE-2014-3596: Fixed missing connection hostname check against X.509 certificate name (bsc#1134598).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-06-03T05:49:35Z","modified":"2026-02-04T04:36:31.140527Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:10646-1","title":"axis-1.4-302.6 on GA media","description":"These are all security issues fixed in the axis-1.4-302.6 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:24:56.528316Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"RHSA-2013:0269","title":"Red Hat Security Advisory: axis security update","status":"published","published":"2024-09-13T08:01:34Z","modified":"2026-08-05T10:02:03Z","updated_at":"2026-11-02T15:53:01.495018Z"},{"id":"RHSA-2013:0683","title":"Red Hat Security Advisory: axis security update","status":"published","published":"2024-09-13T08:02:10Z","modified":"2026-08-05T10:02:11Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"RHSA-2014:0037","title":"Red Hat Security Advisory: jasperreports-server-pro security, bug fix, and enhancement update","status":"published","published":"2024-09-13T08:02:14Z","modified":"2026-08-05T10:02:22Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"RHSA-2014:1123","title":"Red Hat Security Advisory: devtoolset-2-axis security update","status":"published","published":"2024-09-13T08:02:49Z","modified":"2026-08-05T10:02:50Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"SUSE-SU-2019:1373-1","title":"Security update for axis","description":"This update for axis fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2012-5784, CVE-2014-3596: Fixed missing connection hostname check against X.509 certificate name (bsc#1134598).\n","status":"published","published":"2019-05-28T15:00:13Z","modified":"2026-02-04T04:01:56.30312Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:1373-2","title":"Security update for axis","description":"This update for axis fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2012-5784, CVE-2014-3596: Fixed missing connection hostname check against X.509 certificate name (bsc#1134598).\n","status":"published","published":"2019-10-11T15:06:38Z","modified":"2026-02-04T03:38:50.592329Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:1382-1","title":"Security update for axis","description":"This update for axis fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2012-5784, CVE-2014-3596: Fixed missing connection hostname check against X.509 certificate name (bsc#1134598).\n","status":"published","published":"2019-05-30T06:11:19Z","modified":"2026-02-04T03:55:32.869138Z","updated_at":"2026-11-02T15:53:45.926331Z"}]}}