NVD

Id
31754  
Name
CVE-2014-3577  
Description
org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject"s Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field.  
Reject
 
CVSS Version
2  
CVSS Score
5.8  
Severity
Medium  
CVSS Base Score
5.8  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:N)  
Pub Date
2017-01-19  
Published
2014-08-21  
Modified Date
2017-01-10  
Seq
2014-3577  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
167242 31754 CVE-2014-3577 http://packetstormsecurity.com/files/127913/Apache-HttpComponents-Man-In-The-Middle.html  View
167243 31754 CVE-2014-3577 RHSA-2014:1146  View
167244 31754 CVE-2014-3577 RHSA-2014:1166  View
167245 31754 CVE-2014-3577 RHSA-2014:1833  View
167246 31754 CVE-2014-3577 RHSA-2014:1834  View
167247 31754 CVE-2014-3577 RHSA-2014:1835  View
167248 31754 CVE-2014-3577 RHSA-2014:1836  View
167249 31754 CVE-2014-3577 RHSA-2014:1891  View
167250 31754 CVE-2014-3577 RHSA-2014:1892  View
167251 31754 CVE-2014-3577 RHSA-2015:0125  View
167252 31754 CVE-2014-3577 RHSA-2015:0158  View
167253 31754 CVE-2014-3577 RHSA-2015:0675  View
167254 31754 CVE-2014-3577 RHSA-2015:0720  View
167255 31754 CVE-2014-3577 RHSA-2015:0765  View
167256 31754 CVE-2014-3577 RHSA-2015:0850  View
167257 31754 CVE-2014-3577 RHSA-2015:0851  View
167258 31754 CVE-2014-3577 RHSA-2015:1176  View
167259 31754 CVE-2014-3577 RHSA-2015:1177  View
167260 31754 CVE-2014-3577 20140818 CVE-2014-3577: Apache HttpComponents client: Hostname verification susceptible to MITM attack  View
167261 31754 CVE-2014-3577 60466  View
167262 31754 CVE-2014-3577 110143  View
167263 31754 CVE-2014-3577 69258  View
167264 31754 CVE-2014-3577 1030812  View
167265 31754 CVE-2014-3577 USN-2769-1  View
167266 31754 CVE-2014-3577 apache-cve20143577-spoofing(95327)  View
167267 31754 CVE-2014-3577 https://access.redhat.com/solutions/1165533  View
167268 31754 CVE-2014-3577 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05103564  View
167269 31754 CVE-2014-3577 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05363782  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
15017 JVNDB-2014-003892 Apache HttpComponents HttpClient および HttpAsyncClient の org.apache.http.conn.ssl.AbstractVerifier における SSL サーバになりすまされる脆弱性 Apache HttpComponents HttpClient および HttpAsyncClient の org.apache.http.conn.ssl.AbstractVerifier は、サーバのホスト名が X.509 証明書のサブジェクトの Common Name (CN) または subjectAltName フィールドのドメイン名と一致することを適切に検証しないため、SSL サーバになりすまされる脆弱性が存在します。 CVE-2014-3577 70865 CVE-2014-3577 31754 5.8 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-003892.html 2014-08-18 2016-09-30 View