Hostname Verification Flaw in Apache HttpClient 4.3.x by Apache
CVE-2013-4366

9.8CRITICAL

Key Information:

Vendor

Apache
Status
Httpclient
Vendor
CVE Published:
30 October 2017

What is CVE-2013-4366?

The Apache HttpClient 4.3.x versions prior to 4.3.1 expose a vulnerability due to improper handling of the X509HostnameVerifier object. When not properly checked for null, this flaw may allow attackers to exploit hostname verification issues, potentially leading to unauthorized access or man-in-the-middle attacks. Proper implementation of hostname verifiers is essential for ensuring secure communications in applications utilizing this library.

References

http://svn.apache.org/r1528614
x_refsource_CONFIRM
http://www.apache.org/dist/httpcomponents/httpclient/RELE...
x_refsource_CONFIRM

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.