Lucene search

K
ibm
IBMB62A0DF1BA325616E310706F59A3DD07DD7DC7356D343963E6F99C6D89411ED3
HistoryJun 15, 2018 - 7:06 a.m.

Security Bulletin: Vulnerability in legacy component distributed in IBM Development Package for Apache Spark (CVE-2012-5783)

2018-06-1507:06:06
www.ibm.com
5

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

Summary

The Jakarta Commons httpclient version 3.x is known to be vulnerable to SSL spoofing, and is included in the IBM Development Package for Apache Spark, primarily to provide legacy support for Hadoop 2.2. A patch is applied to Jakarta Commons httpclient version 3.1 to fix the vulnerability.

Note: the IBM Development Package for Apache Spark version 1.x provides support for Hadoop 2.6, which does not exercise this vulnerability. The IBM Development Package for Apache Spark version 2.x provides support for Hadoop 2.7.x, which also does not exercise this vulnerability.

Vulnerability Details

CVEID: CVE-2012-5783**
DESCRIPTION:** Apache Commons HttpClient, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, could allow a remote attacker to conduct spoofing attacks, caused by the failure to verify that the server hostname matches a domain name in the subject’s Common Name (CN) field of the X.509 certificate. By persuading a victim to visit a Web site containing a specially-crafted certificate, an attacker could exploit this vulnerability using man-in-the-middle techniques to spoof an SSL server.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/79984 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)

Affected Products and Versions

IBM Development Package for Apache Spark 1.6.2.0 and earlier releases.

Remediation/Fixes

Principal Product and Version(s)

| Remediated Component
—|—
IBM Development Package for Apache Spark 1.6.2.1 and subsequent releases| Patched Jakarta Commons httpclient 3.1
IBM Development Package for Apache Spark 2.0.0.0 and subsequent releases| Patched Jakarta Commons httpclient 3.1

Workarounds and Mitigations

None. A source code patch for the httpclient 3.1 component exists, but this involves a manual process to apply, re-build and re-package into Apache Spark.

IBM recommends upgrading to a remediated release of the IBM Development Package for Apache Spark.

Use Vulners API to create your own security tool

API usage cases
  • Network scanning
  • Linux Patch management
  • Threat protection
  • No network audit solution

Ways of integration

Integrate Vulners API

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

Related for B62A0DF1BA325616E310706F59A3DD07DD7DC7356D343963E6F99C6D89411ED3