Lucene search

K
cve[email protected]CVE-2015-5262
HistoryOct 27, 2015 - 4:59 p.m.

CVE-2015-5262

2015-10-2716:59:00
CWE-399
web.nvd.nist.gov
173
3
apache httpclient
ssl
sslconnectionsocketfactory
https
denial of service
cve-2015-5262

5.2 Medium

AI Score

Confidence

Low

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

0.033 Low

EPSS

Percentile

91.2%

http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.

References

Social References

More

5.2 Medium

AI Score

Confidence

Low

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

0.033 Low

EPSS

Percentile

91.2%