NVD

Id
47092  
Name
CVE-2012-6153  
Description
http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject"s Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5783.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-19  
Published
2014-09-04  
Modified Date
2016-08-22  
Seq
2012-6153  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
235835 47092 CVE-2012-6153 RHSA-2014:1098  View
235836 47092 CVE-2012-6153 RHSA-2014:1833  View
235837 47092 CVE-2012-6153 RHSA-2014:1834  View
235838 47092 CVE-2012-6153 RHSA-2014:1835  View
235839 47092 CVE-2012-6153 RHSA-2014:1836  View
235840 47092 CVE-2012-6153 RHSA-2014:1891  View
235841 47092 CVE-2012-6153 RHSA-2014:1892  View
235842 47092 CVE-2012-6153 RHSA-2015:0125  View
235843 47092 CVE-2012-6153 RHSA-2015:0158  View
235844 47092 CVE-2012-6153 RHSA-2015:0675  View
235845 47092 CVE-2012-6153 RHSA-2015:0720  View
235846 47092 CVE-2012-6153 RHSA-2015:0765  View
235847 47092 CVE-2012-6153 RHSA-2015:0850  View
235848 47092 CVE-2012-6153 RHSA-2015:0851  View
235849 47092 CVE-2012-6153 http://svn.apache.org/viewvc?view=revision&revision=1411705  View
235850 47092 CVE-2012-6153 69257  View
235851 47092 CVE-2012-6153 USN-2769-1  View
235852 47092 CVE-2012-6153 https://access.redhat.com/solutions/1165533  View
235853 47092 CVE-2012-6153 https://bugzilla.redhat.com/show_bug.cgi?id=1129916  View
235854 47092 CVE-2012-6153 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05103564  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
30558 JVNDB-2012-006266 Apache Commons HttpClient の http/conn/ssl/AbstractVerifier.java における SSL サーバになりすまされる脆弱性 Apache Commons HttpClient の http/conn/ssl/AbstractVerifier.java は、サーバのホスト名が X.509 証明書のサブジェクトの Common Name (CN) または subjectAltName フィールドのドメイン名と一致することを適切に検証しないため、SSL サーバになりすまされる脆弱性が存在します。 CVE-2012-6153 59391 CVE-2012-6153 47092 4.3 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-006266.html 2012-11-20 2016-09-30 View