CVE

Id
67344  
CVE No.
CVE-2013-7397  
Status
Candidate  
Description
Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, which allows man-in-the-middle attackers to spoof HTTPS servers by presenting an arbitrary certificate during use of a typical AHC configuration, as demonstrated by a configuration that does not send client certificates.  
Phase
Assigned (20140825)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
649517 67344 CVE-2013-7397 MLIST:[oss-security] 20140825 Re: CVE Request: Multiple issues in com.ning:async-http-client  View
649518 67344 CVE-2013-7397 URL:http://openwall.com/lists/oss-security/2014/08/26/1  View
649519 67344 CVE-2013-7397 CONFIRM:https://github.com/AsyncHttpClient/async-http-client/issues/352  View
649520 67344 CVE-2013-7397 CONFIRM:https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-06-20  View
649521 67344 CVE-2013-7397 REDHAT:RHSA-2015:1176  View
649522 67344 CVE-2013-7397 URL:http://rhn.redhat.com/errata/RHSA-2015-1176.html  View
649523 67344 CVE-2013-7397 REDHAT:RHSA-2015:1551  View
649524 67344 CVE-2013-7397 URL:http://rhn.redhat.com/errata/RHSA-2015-1551.html  View
649525 67344 CVE-2013-7397 BID:69316  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
25127 JVNDB-2013-006704 c-icap の request.c におけるサービス運用妨害 (DoS) の脆弱性 c-icap の request.c には、サービス運用妨害 (クラッシュ) 状態にされる脆弱性が存在します。 CVE-2013-7402 67344 5 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-006704.html  View