Important: jakarta-commons-httpclient

Issue Overview:

Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject’s Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject’s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.

It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject’s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.

Affected Packages:

jakarta-commons-httpclient

Issue Correction:
Run yum update jakarta-commons-httpclient to update your system.

New Packages:

noarch:  
    jakarta-commons-httpclient-manual-3.1-15.8.amzn1.noarch  
    jakarta-commons-httpclient-demo-3.1-15.8.amzn1.noarch  
    jakarta-commons-httpclient-javadoc-3.1-15.8.amzn1.noarch  
    jakarta-commons-httpclient-3.1-15.8.amzn1.noarch  
  
src:  
    jakarta-commons-httpclient-3.1-15.8.amzn1.src  

Additional References

Red Hat: CVE-2012-5783, CVE-2012-6153, CVE-2014-3577

Mitre: CVE-2012-5783, CVE-2012-6153, CVE-2014-3577