{"id":"CVE-2012-6153","aliases":["CLSA-2026-1786536790","CLSA-2026-1790009343","CLSA-2026-1791960465","CLSA-2026-1792010907","CLSA-2026-1792743930","CLSA-2026-1793886295","DEBIAN-CVE-2012-6153","DLA-222-1","EUVD-2018-0479","GHSA-2x83-r56g-cv47","MGASA-2014-0347","MGASA-2014-0348","RHSA-2014:1098","RHSA-2014:1162","RHSA-2014:1320","RHSA-2014:1321","RHSA-2014:1833","RHSA-2014:1834","RHSA-2014:2019","RHSA-2015:0158","UBUNTU-CVE-2012-6153","USN-2769-1"],"status":"published","title":"Improper certificate validation in org.apache.httpcomponents:httpclient","description":"http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field.  NOTE: this issue exists because of an incomplete fix for CVE-2012-5783.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.05844,"percentile":0.93225,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2014-08-25T08:44:11Z","modified":"2026-11-06T13:15:20Z","fixes":[{"ecosystem":"Maven","package":"org.apache.httpcomponents:httpclient","fixed_in":["4.2.3"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.httpcomponents:httpclient","fixed_in":["4.2.1-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"commons-httpclient","fixed_in":["3.1-10.2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"commons-httpclient","fixed_in":["3.1-10.2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"commons-httpclient","fixed_in":["3.1-10.2"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"jakarta-commons-httpclient","fixed_in":["3.1-10.1.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"httpcomponents-client","fixed_in":["4.2.5-1.mga3"],"sources":["osv"]},{"ecosystem":"Red Hat:developer_toolset:2.1::el6","package":"devtoolset-2-httpcomponents-client","fixed_in":["0:4.2.1-6.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:developer_toolset:2.1::el6","package":"devtoolset-2-httpcomponents-client-javadoc","fixed_in":["0:4.2.1-6.el6"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.httpcomponents:httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.httpcomponents:httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2"},{"fixed":"4.2-tuxcare.2"}]}],"versions":["4.2","4.2-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.httpcomponents:httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.1"},{"fixed":"4.2.1-tuxcare.2"}]}],"versions":["4.2.1","4.2.1-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.httpcomponents:httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.2"},{"fixed":"4.1.2-tuxcare.1"}]}],"versions":["4.1.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.httpcomponents:httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.1"},{"fixed":"4.0.1-tuxcare.2"}]}],"versions":["4.0.1","4.0.1-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.httpcomponents:httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.2"},{"fixed":"4.2.2-tuxcare.1"}]}],"versions":["4.2.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.httpcomponents:httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.3"},{"fixed":"4.1.3-tuxcare.1"}]}],"versions":["4.1.3"],"bundled":5},{"source":"osv","ecosystem":"Debian:12","package":"commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-10.2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-10.2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-10.2"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-9+deb6u1"}]}],"versions":["3.1-9"],"bundled":3},{"source":"osv","ecosystem":"Maven","package":"org.apache.httpcomponents:httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3"}]}],"versions":["4.0","4.0-alpha1","4.0-alpha2","4.0-alpha3","4.0-alpha4","4.0-beta1","4.0-beta2","4.0.1","4.0.2","4.0.3","4.1","4.1-alpha1","4.1-alpha2","4.1-beta1","4.1.1","4.1.2","4.1.3","4.2","4.2-alpha1","4.2-beta1","4.2.1","4.2.2"]},{"source":"osv","ecosystem":"Mageia:3","package":"jakarta-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-10.1.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"httpcomponents-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.5-1.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"jakarta-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-11.1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"httpcomponents-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.5-1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:developer_toolset:2.1::el6","package":"devtoolset-2-httpcomponents-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-6.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:developer_toolset:2.1::el6","package":"devtoolset-2-httpcomponents-client-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-6.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"httpclient-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-12.redhat_2.1.ep6.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"httpcomponents-client-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-12.redhat_2.1.ep6.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"httpcomponents-core-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-12.redhat_2.1.ep6.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"httpcomponents-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6-12.redhat_2.1.ep6.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"httpcomponents-project-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6-12.redhat_2.1.ep6.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"httpcore-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-12.redhat_2.1.ep6.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"httpmime-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-12.redhat_2.1.ep6.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"httpclient-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-12.redhat_2.1.ep6.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"httpcomponents-client-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-12.redhat_2.1.ep6.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"httpcomponents-core-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-12.redhat_2.1.ep6.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"httpcomponents-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6-12.redhat_2.1.ep6.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"httpcomponents-project-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6-12.redhat_2.1.ep6.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"httpcore-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-12.redhat_2.1.ep6.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"httpmime-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-12.redhat_2.1.ep6.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el7","package":"httpclient-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-12.redhat_2.1.ep6.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el7","package":"httpcomponents-client-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-12.redhat_2.1.ep6.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el7","package":"httpcomponents-core-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-12.redhat_2.1.ep6.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el7","package":"httpcomponents-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6-12.redhat_2.1.ep6.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el7","package":"httpcomponents-project-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6-12.redhat_2.1.ep6.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el7","package":"httpcore-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-12.redhat_2.1.ep6.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el7","package":"httpmime-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-12.redhat_2.1.ep6.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el5","package":"jakarta-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1-4_patch_02.ep5.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el5","package":"jboss-seam2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.6.EAP5-22_patch_01.ep5.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el5","package":"jboss-seam2-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.6.EAP5-22_patch_01.ep5.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el5","package":"jboss-seam2-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.6.EAP5-22_patch_01.ep5.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el5","package":"jboss-seam2-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.6.EAP5-22_patch_01.ep5.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el6","package":"jakarta-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1-4_patch_02.el6_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el6","package":"jboss-seam2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.6.EAP5-22_patch_01.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el6","package":"jboss-seam2-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.6.EAP5-22_patch_01.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el6","package":"jboss-seam2-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.6.EAP5-22_patch_01.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el6","package":"jboss-seam2-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.6.EAP5-22_patch_01.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el4","package":"jakarta-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1-4_patch_02.ep5.el4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el4","package":"jboss-seam2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.6.EAP5-22_patch_01.ep5.el4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el4","package":"jboss-seam2-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.6.EAP5-22_patch_01.ep5.el4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el4","package":"jboss-seam2-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.6.EAP5-22_patch_01.ep5.el4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el4","package":"jboss-seam2-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.6.EAP5-22_patch_01.ep5.el4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"jakarta-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1-4_patch_02.ep5.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"jboss-seam2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.6.EAP5-22_patch_01.ep5.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"jboss-seam2-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.6.EAP5-22_patch_01.ep5.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"jboss-seam2-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.6.EAP5-22_patch_01.ep5.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"jboss-seam2-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.6.EAP5-22_patch_01.ep5.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"jakarta-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1-4_patch_02.el6_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"jboss-seam2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.6.EAP5-22_patch_01.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"jboss-seam2-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.6.EAP5-22_patch_01.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"jboss-seam2-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.6.EAP5-22_patch_01.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"jboss-seam2-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.6.EAP5-22_patch_01.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el5","package":"apache-cxf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.12-14.patch_09.ep5.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el6","package":"apache-cxf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.12-14.patch_09.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el4","package":"apache-cxf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.12-14.patch_09.ep5.el4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"apache-cxf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.12-14.patch_09.ep5.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"apache-cxf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.12-14.patch_09.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"apache-cxf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.12-1.SP1_redhat_5.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"wss4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.16-2.redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"apache-cxf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.12-1.SP1_redhat_5.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"wss4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.16-2.redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el7","package":"apache-cxf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.12-1.SP1_redhat_5.1.ep6.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el7","package":"wss4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.16-2.redhat_3.1.ep6.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.0-0.29.el6ev"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.0-0.29.el6ev"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-dbscripts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.0-0.29.el6ev"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-extensions-api-impl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.0-0.29.el6ev"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-extensions-api-impl-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.0-0.29.el6ev"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.0-0.29.el6ev"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-restapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.0-0.29.el6ev"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-setup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.0-0.29.el6ev"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-setup-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.0-0.29.el6ev"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-setup-plugin-allinone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.0-0.29.el6ev"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-setup-plugin-ovirt-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.0-0.29.el6ev"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-setup-plugin-ovirt-engine-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.0-0.29.el6ev"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-setup-plugin-websocket-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.0-0.29.el6ev"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.0-0.29.el6ev"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-userportal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.0-0.29.el6ev"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-webadmin-portal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.0-0.29.el6ev"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-websocket-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.0-0.29.el6ev"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-10.2ubuntu0.14.04.1"}]}],"versions":["3.1-10.2"],"bundled":4}],"products":[{"vendor":"apache","product":"commons-httpclient"}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2014-1891.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0765.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/solutions/1165533","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web","article"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0675.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1098.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0720.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1888.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1833.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0850.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0158.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1834.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://svn.apache.org/viewvc?view=revision\u0026revision=1411705","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0125.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1129916","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","advisory","report","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1892.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0851.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05103564","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1835.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.securityfocus.com/bid/69257","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2769-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1836.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-6153","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2x83-r56g-cv47","tags":["advisory"]},{"url":"https://github.com/apache/httpcomponents-client/commit/6e14fc146a66e0f3eb362f45f95d1a58ee18886a","tags":["web"]},{"url":"https://github.com/apache/httpcomponents-client/commit/b930227f907af1198765fc47beabbddae344ca7b","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2012-6153","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0347.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13932","tags":["report"]},{"url":"http://mail-archives.apache.org/mod_mbox/www-announce/201408.mbox/CVE-2014-3577","tags":["advisory"]},{"url":"https://rhn.redhat.com/errata/RHSA-2014-1082.html","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2014-0348.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2014:1098","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1098.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-6153","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-6153","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2014:1162","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1129074","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1162.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-3577","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3577","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3577","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2014:1320","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1320.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2014:1321","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1321.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2014:1833","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1833.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2014:1834","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1834.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2014:2019","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1157304","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_2019.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-3623","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3623","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3623","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2015:0158","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Virtualization/3.5/html/Manager_Release_Notes/index.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=570191","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=716511","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=723211","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=800155","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=804530","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=817180","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=828591","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=832167","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=859024","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=874328","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=878662","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=879077","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=884653","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=890517","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=894027","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=894084","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=895222","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=902298","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=906243","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=906938","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=912057","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=918138","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=920708","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=922377","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=928727","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=947965","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=955235","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=961753","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=962220","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=962880","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=967466","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=977079","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=977306","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=985945","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=987295","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=987299","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=988392","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=988422","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=989546","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=996512","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=999975","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1001419","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1003785","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1007133","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1008512","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1013670","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1014326","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1015186","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1016916","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1022795","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1025376","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1025831","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1028387","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1029934","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1032686","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1034309","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1034885","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1038632","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1040952","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1043430","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1043808","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1044033","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1044042","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1048019","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1052348","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1053884","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1058022","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1059435","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1061156","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1062435","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1064273","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1064544","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1065753","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1067162","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1070348","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1070823","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1071217","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1076705","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1077284","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1079583","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1080144","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1081533","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1081849","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1081896","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1082110","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1082681","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1083760","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1083763","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1083766","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1083769","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1083926","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1083998","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1084120","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1084611","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1085136","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1085380","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1087745","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1087917","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1091692","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1092609","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1092884","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1093393","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1093742","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1093784","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1093786","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1095240","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1096662","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1096971","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1097256","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1097622","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1098591","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1098638","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1098791","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1100194","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1100810","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1101018","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1101565","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1102018","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1103490","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1103676","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1103707","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1103976","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1104030","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1104195","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1104233","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1109326","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1109721","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1110172","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1110636","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1111551","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1112359","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1113499","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1113937","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1114041","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1114241","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1114244","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1114253","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1114260","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1114554","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1115845","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1115966","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1116486","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1118191","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1118818","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1118847","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1118879","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1119922","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1120197","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1120829","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1120858","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1121454","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1123396","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1123754","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1125834","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1126839","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1128949","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1129012","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1129634","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1130076","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1131693","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1132078","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1132191","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1133938","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1134009","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1136087","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1139866","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1140098","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1140430","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1141693","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1142233","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1148379","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1148623","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1149135","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1149235","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1153544","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1154607","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1154630","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1156577","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1157211","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1160889","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0158.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0151","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0151","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0151","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0154","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0154","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0154","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2012-6153","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2769-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2012-5783","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-3577","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-5262","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2012-6153","description":"http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field.  NOTE: this issue exists because of an incomplete fix for CVE-2012-5783.","status":"published","published":"2014-09-04T17:00:00Z","modified":"2024-08-06T21:28:39.315Z","updated_at":"2026-11-02T14:34:50.94153Z"}],"euvd":[{"id":"EUVD-2018-0479","description":"http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field.  NOTE: this issue exists because of an incomplete fix for CVE-2012-5783.","status":"published","published":"2014-09-04T17:00:00Z","modified":"2024-08-06T21:28:39Z","updated_at":"2026-11-03T01:56:02.409289Z"}],"ghsa":[{"id":"GHSA-2x83-r56g-cv47","title":"Improper certificate validation in org.apache.httpcomponents:httpclient","description":"http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5783.","status":"published","published":"2018-10-17T00:05:15Z","modified":"2024-03-05T18:49:28Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:37:39.730152Z"}],"nvd":[{"id":"CVE-2012-6153","description":"http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field.  NOTE: this issue exists because of an incomplete fix for CVE-2012-5783.","status":"published","published":"2014-09-04T17:55:04.623Z","modified":"2026-06-16T23:47:55.373Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:17.748457Z"}],"osv":[{"id":"RHSA-2014:1162","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.0 security update","status":"published","published":"2024-09-13T09:19:09Z","modified":"2026-08-09T10:01:35Z","cvss":[{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"RHSA-2014:1320","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Web Platform 5.2.0 security update","status":"published","published":"2024-09-13T09:19:55Z","modified":"2026-08-09T10:01:35Z","cvss":[{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"RHSA-2014:1321","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 5.2.0 security update","status":"published","published":"2024-09-13T09:20:00Z","modified":"2026-08-09T10:01:36Z","cvss":[{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"RHSA-2014:1833","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Web Platform 5.2.0 security update","status":"published","published":"2024-09-13T09:20:20Z","modified":"2026-08-09T10:01:36Z","cvss":[{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"RHSA-2014:1834","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 5.2.0 security update","status":"published","published":"2024-09-13T09:20:26Z","modified":"2026-08-09T10:01:37Z","cvss":[{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"RHSA-2014:2019","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.2 security update","status":"published","published":"2024-09-13T09:20:43Z","modified":"2026-08-09T10:01:37Z","cvss":[{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"RHSA-2015:0158","title":"Red Hat Security Advisory: Red Hat Enterprise Virtualization Manager 3.5.0","status":"published","published":"2024-09-13T09:20:59Z","modified":"2026-08-09T10:01:38Z","cvss":[{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"CLSA-2026-1786536790","title":"TuxCare security update for org.apache.httpcomponents:httpclient (2 CVEs)","description":"TuxCare rebuilt org.apache.httpcomponents:httpclient to address 2 CVEs. Fixed in 4.2-tuxcare.2.","status":"published","published":"2026-08-12T12:13:10Z","modified":"2026-11-02T19:45:53.389780238Z","updated_at":"2026-11-02T20:30:00.884471Z"},{"id":"CLSA-2026-1790009343","title":"TuxCare security update for org.apache.httpcomponents:httpclient (1 CVE)","description":"TuxCare rebuilt org.apache.httpcomponents:httpclient to address 1 CVE. Fixed in 4.2.1-tuxcare.2.","status":"published","published":"2026-09-21T16:49:03Z","modified":"2026-11-02T19:46:18.562623992Z","updated_at":"2026-11-02T20:29:28.838259Z"},{"id":"CLSA-2026-1791960465","title":"TuxCare security update for org.apache.httpcomponents:httpclient (3 CVEs)","description":"TuxCare rebuilt org.apache.httpcomponents:httpclient to address 3 CVEs. Fixed in 4.1.2-tuxcare.1.","status":"published","published":"2026-10-14T06:47:45Z","modified":"2026-11-02T19:46:27.306917297Z","updated_at":"2026-11-02T20:29:13.152182Z"},{"id":"CLSA-2026-1792010907","title":"TuxCare security update for org.apache.httpcomponents:httpclient (2 CVEs)","description":"TuxCare rebuilt org.apache.httpcomponents:httpclient to address 2 CVEs. Fixed in 4.0.1-tuxcare.2.","status":"published","published":"2026-10-14T20:48:27Z","modified":"2026-11-02T19:46:28.028666288Z","updated_at":"2026-11-02T20:29:13.152182Z"},{"id":"CLSA-2026-1792743930","title":"TuxCare security update for org.apache.httpcomponents:httpclient (3 CVEs)","description":"TuxCare rebuilt org.apache.httpcomponents:httpclient to address 3 CVEs. Fixed in 4.2.2-tuxcare.1.","status":"published","published":"2026-10-23T08:25:30Z","modified":"2026-11-02T19:46:30.998382044Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793886295","title":"TuxCare security update for org.apache.httpcomponents:httpclient (5 CVEs)","description":"TuxCare rebuilt org.apache.httpcomponents:httpclient to address 5 CVEs. Fixed in 4.1.3-tuxcare.1.","status":"published","published":"2026-11-05T14:44:56Z","modified":"2026-11-06T13:15:20.815432202Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CVE-2012-6153","description":"http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field.  NOTE: this issue exists because of an incomplete fix for CVE-2012-5783.","status":"published","published":"2014-09-04T17:55:04Z","modified":"2026-04-16T06:24:13.636468625Z","updated_at":"2026-11-02T15:43:58.802805Z"},{"id":"DEBIAN-CVE-2012-6153","description":"http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field.  NOTE: this issue exists because of an incomplete fix for CVE-2012-5783.","status":"published","published":"2014-09-04T17:55:04.623Z","modified":"2026-10-23T17:47:38.521966199Z","updated_at":"2026-11-02T15:45:25.218101Z"},{"id":"DLA-222-1","title":"commons-httpclient - security update","status":"published","published":"2015-05-16T00:00:00Z","modified":"2026-03-09T01:19:25.566236Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"GHSA-2x83-r56g-cv47","title":"Improper certificate validation in org.apache.httpcomponents:httpclient","description":"http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5783.","status":"published","published":"2018-10-17T00:05:15Z","modified":"2024-12-02T05:48:49.049751Z","cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:35.050232Z"},{"id":"MGASA-2014-0347","title":"Updated jakarta-commons-httpclient and httpcomponents-client packages fix security vulnerability","description":"Updated jakarta-commons-httpclient and httpcomponents-client packages fix\nsecurity vulnerability:\n\nThe Jakarta Commons HttpClient and Apache httpcomponents HttpClient\ncomponents may be susceptible to a 'Man in the Middle Attack' due to a flaw\nin the default hostname verification during SSL/TLS when a specially crafted\nserver side certificate is used (CVE-2012-6153).\n","status":"published","published":"2014-08-25T08:44:11Z","modified":"2026-04-16T06:22:35.976670568Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"MGASA-2014-0348","title":"Updated jakarta-commons-httpclient and httpcomponents-client packages fix security vulnerabilities","description":"Updated jakarta-commons-httpclient and httpcomponents-client packages fix\nsecurity vulnerabilities:\n\nThe Jakarta Commons HttpClient component may be susceptible to a 'Man in the\nMiddle Attack' due to a flaw in the default hostname verification during\nSSL/TLS when a specially crafted server side certificate is used\n(CVE-2012-6153).\n\nThe Apache httpcomponents HttpClient component may be susceptible to a 'Man\nin the Middle Attack' due to a flaw in the default hostname verification\nduring SSL/TLS when a specially crafted server side certificate is used\n(CVE-2014-3577).\n","status":"published","published":"2014-08-25T08:44:11Z","modified":"2026-04-16T06:22:32.872432099Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"RHSA-2014:1098","title":"Red Hat Security Advisory: devtoolset-2-httpcomponents-client security update","status":"published","published":"2024-09-13T08:02:44Z","modified":"2026-08-09T10:01:34Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"UBUNTU-CVE-2012-6153","description":"http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field.  NOTE: this issue exists because of an incomplete fix for CVE-2012-5783.","status":"withdrawn","published":"2014-09-04T00:00:00Z","modified":"2026-02-04T03:01:11.664274Z","updated_at":"2026-11-02T15:54:06.854805Z"},{"id":"USN-2769-1","title":"commons-httpclient vulnerabilities","description":"It was discovered that Apache Commons HttpClient did not properly verify the\nCommon Name or subjectAltName fields of X.509 certificates. An attacker could\nexploit this to perform a machine-in-the-middle attack to view sensitive\ninformation or alter encrypted communications. This issue only affected Ubuntu\n12.04 LTS. (CVE-2012-5783)\n\nFlorian Weimer discovered the fix for CVE-2012-5783 was incomplete for Apache\nCommons HttpClient. An attacker could exploit this to perform a\nmachine-in-the-middle attack to view sensitive information or alter\nencrypted communications. This issue only affected Ubuntu 12.04 LTS.\n(CVE-2012-6153)\n\nSubodh Iyengar and Will Shackleton discovered the fix for CVE-2012-5783 was\nincomplete for Apache Commons HttpClient. An attacker could exploit this to\nperform a machine-in-the-middle attack to view sensitive information or alter\nencrypted communications. (CVE-2014-3577)\n\nIt was discovered that Apache Commons HttpClient did not properly handle read\ntimeouts during HTTPS handshakes. A remote attacker could trigger this flaw to\ncause a denial of service. (CVE-2015-5262)\n","status":"published","published":"2015-10-14T15:43:52Z","modified":"2026-02-10T04:40:55Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}