Server Hostname Verification Issue in Apache Commons HttpClient

CVE-2012-6153

Summary

The Apache Commons HttpClient library prior to version 4.2.3 contains a flaw in the hostname verification process. The implementation fails to accurately check if the server's hostname corresponds to the domain name specified in the X.509 certificate’s Common Name (CN) or subjectAltName fields. This exposes the application to man-in-the-middle attacks, where malicious actors can exploit this weakness to present fraudulent SSL certificates, enabling them to masquerade as legitimate servers. This vulnerability exists due to an incomplete fix associated with a previous advisory.

References