{"id": "REDHAT-RHSA-2014-1166.NASL", "bulletinFamily": "scanner", "title": "RHEL 5 / 6 / 7 : jakarta-commons-httpclient (RHSA-2014:1166)", "description": "Updated jakarta-commons-httpclient packages that fix one security\nissue are now available for Red Hat Enterprise Linux 5, 6, and 7.\n\nRed Hat Product Security has rated this update as having Important\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available from the\nCVE link in the References section.\n\nJakarta Commons HTTPClient implements the client side of HTTP\nstandards.\n\nIt was discovered that the HTTPClient incorrectly extracted host name\nfrom an X.509 certificate subject", "published": "2014-09-09T00:00:00", "modified": "2019-11-02T00:00:00", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}, "href": "https://www.tenable.com/plugins/nessus/77567", "reporter": "This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["https://access.redhat.com/errata/RHSA-2014:1166", "https://access.redhat.com/security/cve/cve-2014-3577", "https://access.redhat.com/solutions/1165533"], "cvelist": ["CVE-2014-3577"], "type": "nessus", "lastseen": "2019-11-01T03:20:53", "history": [{"bulletin": {"bulletinFamily": "scanner", "cpe": ["cpe:/o:redhat:enterprise_linux:5", "cpe:/o:redhat:enterprise_linux:6.5", "cpe:/o:redhat:enterprise_linux:7.4", "cpe:/o:redhat:enterprise_linux:7.7", "p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient", "cpe:/o:redhat:enterprise_linux:7.5", "cpe:/o:redhat:enterprise_linux:7", "p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient-manual", "cpe:/o:redhat:enterprise_linux:7.3", "cpe:/o:redhat:enterprise_linux:7.6", "cpe:/o:redhat:enterprise_linux:6", "p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient-javadoc", "p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient-debuginfo", "p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient-demo"], "cvelist": ["CVE-2014-3577"], "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}, "description": "Updated jakarta-commons-httpclient packages that fix one security\nissue are now available for Red Hat Enterprise Linux 5, 6, and 7.\n\nRed Hat Product Security has rated this update as having Important\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available from the\nCVE link in the References section.\n\nJakarta Commons HTTPClient implements the client side of HTTP\nstandards.\n\nIt was discovered that the HTTPClient incorrectly extracted host name\nfrom an X.509 certificate subject", "edition": 14, "enchantments": {"dependencies": {"modified": "2019-10-28T21:08:15", "references": [{"idList": ["SOL15737", "F5:K15364328", "SOL15364328"], "type": "f5"}, {"idList": ["RHSA-2016:1931", "RHSA-2014:1834", "RHSA-2014:1146", "RHSA-2014:1321", "RHSA-2014:1320", "RHSA-2014:1833", "RHSA-2014:1082", "RHSA-2014:1892", "RHSA-2014:1166", "RHSA-2014:1891"], "type": "redhat"}, {"idList": ["ATLASSIAN:CWD-4355"], "type": "atlassian"}, {"idList": ["OPENVAS:1361412562310123318", "OPENVAS:1361412562310882010", "OPENVAS:1361412562310868154", "OPENVAS:1361412562310882002", "OPENVAS:1361412562310123321", "OPENVAS:1361412562310871238", "OPENVAS:1361412562310871237", "OPENVAS:1361412562310868159", "OPENVAS:1361412562310882000", "OPENVAS:1361412562310106512"], "type": "openvas"}, {"idList": ["CESA-2014:1146", "CESA-2014:1166"], "type": "centos"}, {"idList": ["CVE-2014-3577"], "type": "cve"}, {"idList": ["DEBIAN:DLA-222-1:38FAF"], "type": "debian"}, {"idList": ["ELSA-2014-1166", "ELSA-2014-1146"], "type": "oraclelinux"}, {"idList": ["SECURITYVULNS:DOC:32573", "SECURITYVULNS:DOC:31006", "SECURITYVULNS:VULN:13923"], "type": "securityvulns"}, {"idList": ["CENTOS_RHSA-2014-1146.NASL", "FEDORA_2014-9617.NASL", "ORACLELINUX_ELSA-2014-1146.NASL", "FREEBSD_PKG_AC18046C9B0811E68011005056925DB4.NASL", "REDHAT-RHSA-2014-1146.NASL", "ORACLELINUX_ELSA-2014-1166.NASL", "REDHAT-RHSA-2014-1833.NASL", "REDHAT-RHSA-2014-1834.NASL", "CENTOS_RHSA-2014-1166.NASL", "FEDORA_2014-9629.NASL"], "type": "nessus"}, {"idList": ["ORACLE:CPUJUL2018-4258247"], "type": "oracle"}, {"idList": ["ALAS-2014-410"], "type": "amazon"}, {"idList": ["AC18046C-9B08-11E6-8011-005056925DB4"], "type": "freebsd"}, {"idList": ["USN-2769-1"], "type": "ubuntu"}]}, "score": {"modified": "2019-10-28T21:08:15", "value": 5.9, "vector": "NONE"}}, "hash": "358bb5c17253a856a989b5085ca8f5dd5c0d2e5deb47913f0f1db6cf02756319", "hashmap": [{"hash": "fe0021c9f64646252fc8c9f8d8b657e4", "key": "href"}, {"hash": "0fb1014b4614192eebbaf69393c57e18", "key": "reporter"}, {"hash": "c8e3454d64838986e9614151dc781f59", "key": "cvelist"}, {"hash": "cd6bdc0033f1c8423017e14954971fe2", "key": "cpe"}, {"hash": "488b1917e9a66426ef13edb42cef1116", "key": "sourceData"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "0bafb6325bcaf483a25404f785191cc5", "key": "modified"}, {"hash": "c3c91421e192e0e8141c03da51a74b99", "key": "cvss"}, {"hash": "e417addab555c2a8899b082952e8abb3", "key": "title"}, {"hash": "44b4ddcd5efd170dee3d948c929fd264", "key": "description"}, {"hash": "1faab713327e700e42d81a14cb4b60ba", "key": "pluginID"}, {"hash": "5df7238f8549d311d366978ad5e49d1a", "key": "published"}, {"hash": "dd2fc9858f85d86338942c8a8b9c724a", "key": "references"}, {"hash": "b46559ea68ec9a13474c3a7776817cfd", "key": "naslFamily"}], "history": [], "href": "https://www.tenable.com/plugins/nessus/77567", "id": "REDHAT-RHSA-2014-1166.NASL", "lastseen": "2019-10-28T21:08:15", "modified": "2019-10-02T00:00:00", "naslFamily": "Red Hat Local Security Checks", "objectVersion": "1.3", "pluginID": "77567", "published": "2014-09-09T00:00:00", "references": ["https://access.redhat.com/errata/RHSA-2014:1166", "https://access.redhat.com/security/cve/cve-2014-3577", "https://access.redhat.com/solutions/1165533"], "reporter": "This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2014:1166. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(77567);\n script_version(\"1.19\");\n script_cvs_date(\"Date: 2019/10/24 15:35:38\");\n\n script_cve_id(\"CVE-2014-3577\");\n script_bugtraq_id(69258);\n script_xref(name:\"RHSA\", value:\"2014:1166\");\n\n script_name(english:\"RHEL 5 / 6 / 7 : jakarta-commons-httpclient (RHSA-2014:1166)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated jakarta-commons-httpclient packages that fix one security\nissue are now available for Red Hat Enterprise Linux 5, 6, and 7.\n\nRed Hat Product Security has rated this update as having Important\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available from the\nCVE link in the References section.\n\nJakarta Commons HTTPClient implements the client side of HTTP\nstandards.\n\nIt was discovered that the HTTPClient incorrectly extracted host name\nfrom an X.509 certificate subject's Common Name (CN) field. A\nman-in-the-middle attacker could use this flaw to spoof an SSL server\nusing a specially crafted X.509 certificate. (CVE-2014-3577)\n\nFor additional information on this flaw, refer to the Knowledgebase\narticle in the References section.\n\nAll jakarta-commons-httpclient users are advised to upgrade to these\nupdated packages, which contain a backported patch to correct this\nissue.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/solutions/1165533\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2014:1166\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2014-3577\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient-demo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient-javadoc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient-manual\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:5\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:6.5\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.3\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.5\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.7\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2014/08/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/09/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/09/09\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(5|6|7)([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 5.x / 6.x / 7.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2014:1166\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n if (rpm_exists(rpm:\"jakarta-commons-httpclient-3.0-7\", release:\"RHEL5\") && rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"jakarta-commons-httpclient-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_exists(rpm:\"jakarta-commons-httpclient-3.0-7\", release:\"RHEL5\") && rpm_check(release:\"RHEL5\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_exists(rpm:\"jakarta-commons-httpclient-3.0-7\", release:\"RHEL5\") && rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"jakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"jakarta-commons-httpclient-demo-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-demo-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-demo-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"jakarta-commons-httpclient-javadoc-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-javadoc-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-javadoc-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"jakarta-commons-httpclient-manual-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-manual-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-manual-3.0-7jpp.4.el5_10\")) flag++;\n\n\n if (rpm_exists(rpm:\"jakarta-commons-httpclient-3.1-0\", release:\"RHEL6\") && rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"jakarta-commons-httpclient-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_exists(rpm:\"jakarta-commons-httpclient-3.1-0\", release:\"RHEL6\") && rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_exists(rpm:\"jakarta-commons-httpclient-3.1-0\", release:\"RHEL6\") && rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"jakarta-commons-httpclient-debuginfo-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-debuginfo-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-debuginfo-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"jakarta-commons-httpclient-demo-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-demo-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-demo-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"jakarta-commons-httpclient-javadoc-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-javadoc-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-javadoc-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"jakarta-commons-httpclient-manual-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-manual-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-manual-3.1-0.9.el6_5\")) flag++;\n\n\n if (rpm_exists(rpm:\"jakarta-commons-httpclient-3.1-16\", release:\"RHEL7\") && rpm_check(release:\"RHEL7\", reference:\"jakarta-commons-httpclient-3.1-16.el7_0\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", reference:\"jakarta-commons-httpclient-demo-3.1-16.el7_0\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", reference:\"jakarta-commons-httpclient-javadoc-3.1-16.el7_0\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", reference:\"jakarta-commons-httpclient-manual-3.1-16.el7_0\")) flag++;\n\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"jakarta-commons-httpclient / jakarta-commons-httpclient-debuginfo / etc\");\n }\n}\n", "title": "RHEL 5 / 6 / 7 : jakarta-commons-httpclient (RHSA-2014:1166)", "type": "nessus", "viewCount": 3}, "differentElements": ["modified"], "edition": 14, "lastseen": "2019-10-28T21:08:15"}, {"bulletin": {"bulletinFamily": "scanner", "cpe": ["cpe:/o:redhat:enterprise_linux:5", "cpe:/o:redhat:enterprise_linux:6.5", "cpe:/o:redhat:enterprise_linux:7.4", "p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient", "cpe:/o:redhat:enterprise_linux:7.5", "cpe:/o:redhat:enterprise_linux:7", "p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient-manual", "cpe:/o:redhat:enterprise_linux:7.3", "cpe:/o:redhat:enterprise_linux:6", "p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient-javadoc", "p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient-debuginfo", "p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient-demo"], "cvelist": ["CVE-2014-3577"], "cvss": {"score": 5.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "description": "Updated jakarta-commons-httpclient packages that fix one security issue are now available for Red Hat Enterprise Linux 5, 6, and 7.\n\nRed Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.\n\nJakarta Commons HTTPClient implements the client side of HTTP standards.\n\nIt was discovered that the HTTPClient incorrectly extracted host name from an X.509 certificate subject's Common Name (CN) field. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate. (CVE-2014-3577)\n\nFor additional information on this flaw, refer to the Knowledgebase article in the References section.\n\nAll jakarta-commons-httpclient users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.", "edition": 7, "enchantments": {"score": {"value": 5.0, "vector": "NONE"}}, "hash": "926c98da5a5031cae81d78daccd20bd1a9b3eee6837ba5a4c0c2bfb6561a5cd8", "hashmap": [{"hash": "bf0082084ad0a1cf00e46bcd2628ed70", "key": "references"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "9086335852a7283db58febb65140689b", "key": "description"}, {"hash": "c8e3454d64838986e9614151dc781f59", "key": "cvelist"}, {"hash": "f88d50f5167050f5b3367c6d99617b00", "key": "modified"}, {"hash": "aa48a6bdcab91a600eca490863982fbd", "key": "cvss"}, {"hash": "2bc03e5df4a05cfe44f162123d541df0", "key": "cpe"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "e417addab555c2a8899b082952e8abb3", "key": "title"}, {"hash": "7158555fc393f099b668583389d998dc", "key": "href"}, {"hash": "1faab713327e700e42d81a14cb4b60ba", "key": "pluginID"}, {"hash": "5df7238f8549d311d366978ad5e49d1a", "key": "published"}, {"hash": "b46559ea68ec9a13474c3a7776817cfd", "key": "naslFamily"}, {"hash": "dc978dbeecd8c0faaa0b2ea029491d10", "key": "sourceData"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=77567", "id": "REDHAT-RHSA-2014-1166.NASL", "lastseen": "2018-09-14T11:53:37", "modified": "2018-09-12T00:00:00", "naslFamily": "Red Hat Local Security Checks", "objectVersion": "1.3", "pluginID": "77567", "published": "2014-09-09T00:00:00", "references": ["http://rhn.redhat.com/errata/RHSA-2014-1166.html", "https://www.redhat.com/security/data/cve/CVE-2014-3577.html", "https://access.redhat.com/solutions/1165533"], "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2014:1166. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(77567);\n script_version(\"1.11\");\n script_cvs_date(\"Date: 2018/09/12 15:00:26\");\n\n script_cve_id(\"CVE-2014-3577\");\n script_bugtraq_id(69258);\n script_xref(name:\"RHSA\", value:\"2014:1166\");\n\n script_name(english:\"RHEL 5 / 6 / 7 : jakarta-commons-httpclient (RHSA-2014:1166)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated jakarta-commons-httpclient packages that fix one security\nissue are now available for Red Hat Enterprise Linux 5, 6, and 7.\n\nRed Hat Product Security has rated this update as having Important\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available from the\nCVE link in the References section.\n\nJakarta Commons HTTPClient implements the client side of HTTP\nstandards.\n\nIt was discovered that the HTTPClient incorrectly extracted host name\nfrom an X.509 certificate subject's Common Name (CN) field. A\nman-in-the-middle attacker could use this flaw to spoof an SSL server\nusing a specially crafted X.509 certificate. (CVE-2014-3577)\n\nFor additional information on this flaw, refer to the Knowledgebase\narticle in the References section.\n\nAll jakarta-commons-httpclient users are advised to upgrade to these\nupdated packages, which contain a backported patch to correct this\nissue.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/solutions/1165533\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://rhn.redhat.com/errata/RHSA-2014-1166.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.redhat.com/security/data/cve/CVE-2014-3577.html\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient-demo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient-javadoc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient-manual\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:5\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:6.5\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.3\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.5\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/09/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/09/09\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = eregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^(5|6|7)([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 5.x / 6.x / 7.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2014:1166\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n if (rpm_exists(rpm:\"jakarta-commons-httpclient-3.0-7\", release:\"RHEL5\") && rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"jakarta-commons-httpclient-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_exists(rpm:\"jakarta-commons-httpclient-3.0-7\", release:\"RHEL5\") && rpm_check(release:\"RHEL5\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_exists(rpm:\"jakarta-commons-httpclient-3.0-7\", release:\"RHEL5\") && rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"jakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"jakarta-commons-httpclient-demo-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-demo-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-demo-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"jakarta-commons-httpclient-javadoc-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-javadoc-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-javadoc-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"jakarta-commons-httpclient-manual-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-manual-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-manual-3.0-7jpp.4.el5_10\")) flag++;\n\n\n if (rpm_exists(rpm:\"jakarta-commons-httpclient-3.1-0\", release:\"RHEL6\") && rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"jakarta-commons-httpclient-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_exists(rpm:\"jakarta-commons-httpclient-3.1-0\", release:\"RHEL6\") && rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_exists(rpm:\"jakarta-commons-httpclient-3.1-0\", release:\"RHEL6\") && rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"jakarta-commons-httpclient-debuginfo-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-debuginfo-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-debuginfo-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"jakarta-commons-httpclient-demo-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-demo-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-demo-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"jakarta-commons-httpclient-javadoc-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-javadoc-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-javadoc-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"jakarta-commons-httpclient-manual-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-manual-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-manual-3.1-0.9.el6_5\")) flag++;\n\n\n if (rpm_exists(rpm:\"jakarta-commons-httpclient-3.1-16\", release:\"RHEL7\") && rpm_check(release:\"RHEL7\", reference:\"jakarta-commons-httpclient-3.1-16.el7_0\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", reference:\"jakarta-commons-httpclient-demo-3.1-16.el7_0\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", reference:\"jakarta-commons-httpclient-javadoc-3.1-16.el7_0\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", reference:\"jakarta-commons-httpclient-manual-3.1-16.el7_0\")) flag++;\n\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"jakarta-commons-httpclient / jakarta-commons-httpclient-debuginfo / etc\");\n }\n}\n", "title": "RHEL 5 / 6 / 7 : jakarta-commons-httpclient (RHSA-2014:1166)", "type": "nessus", "viewCount": 3}, "differentElements": ["modified", "cpe", "sourceData"], "edition": 7, "lastseen": "2018-09-14T11:53:37"}, {"bulletin": {"bulletinFamily": "scanner", "cpe": [], "cvelist": ["CVE-2014-3577"], "cvss": {"score": 5.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "description": "Updated jakarta-commons-httpclient packages that fix one security issue are now available for Red Hat Enterprise Linux 5, 6, and 7.\n\nRed Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.\n\nJakarta Commons HTTPClient implements the client side of HTTP standards.\n\nIt was discovered that the HTTPClient incorrectly extracted host name from an X.509 certificate subject's Common Name (CN) field. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate. (CVE-2014-3577)\n\nFor additional information on this flaw, refer to the Knowledgebase article in the References section.\n\nAll jakarta-commons-httpclient users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.", "edition": 2, "enchantments": {}, "hash": "ff55151cf77c843314e61b3ff9e3b72822f36889296ff8900084d87e86c2242b", "hashmap": [{"hash": "3c56ce37c7228a5617a8007318ab4b21", "key": "modified"}, {"hash": "bf0082084ad0a1cf00e46bcd2628ed70", "key": "references"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "9086335852a7283db58febb65140689b", "key": "description"}, {"hash": "c8e3454d64838986e9614151dc781f59", "key": "cvelist"}, {"hash": "aa48a6bdcab91a600eca490863982fbd", "key": "cvss"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "d767f1a7eb2a979368520f3fa52adc3b", "key": "sourceData"}, {"hash": "e417addab555c2a8899b082952e8abb3", "key": "title"}, {"hash": "7158555fc393f099b668583389d998dc", "key": "href"}, {"hash": "1faab713327e700e42d81a14cb4b60ba", "key": "pluginID"}, {"hash": "5df7238f8549d311d366978ad5e49d1a", "key": "published"}, {"hash": "b46559ea68ec9a13474c3a7776817cfd", "key": "naslFamily"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=77567", "id": "REDHAT-RHSA-2014-1166.NASL", "lastseen": "2017-01-06T22:10:06", "modified": "2017-01-06T00:00:00", "naslFamily": "Red Hat Local Security Checks", "objectVersion": "1.2", "pluginID": "77567", "published": "2014-09-09T00:00:00", "references": ["http://rhn.redhat.com/errata/RHSA-2014-1166.html", "https://www.redhat.com/security/data/cve/CVE-2014-3577.html", "https://access.redhat.com/solutions/1165533"], "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2014:1166. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(77567);\n script_version(\"$Revision: 1.9 $\");\n script_cvs_date(\"$Date: 2017/01/06 15:50:59 $\");\n\n script_cve_id(\"CVE-2014-3577\");\n script_bugtraq_id(69258);\n script_osvdb_id(110143);\n script_xref(name:\"RHSA\", value:\"2014:1166\");\n\n script_name(english:\"RHEL 5 / 6 / 7 : jakarta-commons-httpclient (RHSA-2014:1166)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated jakarta-commons-httpclient packages that fix one security\nissue are now available for Red Hat Enterprise Linux 5, 6, and 7.\n\nRed Hat Product Security has rated this update as having Important\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available from the\nCVE link in the References section.\n\nJakarta Commons HTTPClient implements the client side of HTTP\nstandards.\n\nIt was discovered that the HTTPClient incorrectly extracted host name\nfrom an X.509 certificate subject's Common Name (CN) field. A\nman-in-the-middle attacker could use this flaw to spoof an SSL server\nusing a specially crafted X.509 certificate. (CVE-2014-3577)\n\nFor additional information on this flaw, refer to the Knowledgebase\narticle in the References section.\n\nAll jakarta-commons-httpclient users are advised to upgrade to these\nupdated packages, which contain a backported patch to correct this\nissue.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.redhat.com/security/data/cve/CVE-2014-3577.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/solutions/1165533\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://rhn.redhat.com/errata/RHSA-2014-1166.html\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:ND\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient-demo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient-javadoc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient-manual\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:5\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:6.5\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/09/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/09/09\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2017 Tenable Network Security, Inc.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = eregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^(5|6|7)([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 5.x / 6.x / 7.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2014:1166\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n if (rpm_exists(rpm:\"jakarta-commons-httpclient-3.0-7\", release:\"RHEL5\") && rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"jakarta-commons-httpclient-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_exists(rpm:\"jakarta-commons-httpclient-3.0-7\", release:\"RHEL5\") && rpm_check(release:\"RHEL5\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_exists(rpm:\"jakarta-commons-httpclient-3.0-7\", release:\"RHEL5\") && rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"jakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"jakarta-commons-httpclient-demo-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-demo-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-demo-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"jakarta-commons-httpclient-javadoc-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-javadoc-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-javadoc-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"jakarta-commons-httpclient-manual-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-manual-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-manual-3.0-7jpp.4.el5_10\")) flag++;\n\n\n if (rpm_exists(rpm:\"jakarta-commons-httpclient-3.1-0\", release:\"RHEL6\") && rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"jakarta-commons-httpclient-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_exists(rpm:\"jakarta-commons-httpclient-3.1-0\", release:\"RHEL6\") && rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_exists(rpm:\"jakarta-commons-httpclient-3.1-0\", release:\"RHEL6\") && rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"jakarta-commons-httpclient-debuginfo-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-debuginfo-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-debuginfo-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"jakarta-commons-httpclient-demo-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-demo-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-demo-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"jakarta-commons-httpclient-javadoc-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-javadoc-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-javadoc-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"jakarta-commons-httpclient-manual-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-manual-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-manual-3.1-0.9.el6_5\")) flag++;\n\n\n if (rpm_exists(rpm:\"jakarta-commons-httpclient-3.1-16\", release:\"RHEL7\") && rpm_check(release:\"RHEL7\", reference:\"jakarta-commons-httpclient-3.1-16.el7_0\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", reference:\"jakarta-commons-httpclient-demo-3.1-16.el7_0\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", reference:\"jakarta-commons-httpclient-javadoc-3.1-16.el7_0\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", reference:\"jakarta-commons-httpclient-manual-3.1-16.el7_0\")) flag++;\n\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"jakarta-commons-httpclient / jakarta-commons-httpclient-debuginfo / etc\");\n }\n}\n", "title": "RHEL 5 / 6 / 7 : jakarta-commons-httpclient (RHSA-2014:1166)", "type": "nessus", "viewCount": 3}, "differentElements": ["cpe"], "edition": 2, "lastseen": "2017-01-06T22:10:06"}, {"bulletin": {"bulletinFamily": "scanner", "cpe": ["cpe:/o:redhat:enterprise_linux:5", "cpe:/o:redhat:enterprise_linux:6.5", "cpe:/o:redhat:enterprise_linux:7.4", "p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient", "cpe:/o:redhat:enterprise_linux:7.5", "cpe:/o:redhat:enterprise_linux:7", "p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient-manual", "cpe:/o:redhat:enterprise_linux:7.3", "cpe:/o:redhat:enterprise_linux:7.6", "cpe:/o:redhat:enterprise_linux:6", "p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient-javadoc", "p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient-debuginfo", "p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient-demo"], "cvelist": ["CVE-2014-3577"], "cvss": {"score": 5.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "description": "Updated jakarta-commons-httpclient packages that fix one security\nissue are now available for Red Hat Enterprise Linux 5, 6, and 7.\n\nRed Hat Product Security has rated this update as having Important\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available from the\nCVE link in the References section.\n\nJakarta Commons HTTPClient implements the client side of HTTP\nstandards.\n\nIt was discovered that the HTTPClient incorrectly extracted host name\nfrom an X.509 certificate subject's Common Name (CN) field. A\nman-in-the-middle attacker could use this flaw to spoof an SSL server\nusing a specially crafted X.509 certificate. (CVE-2014-3577)\n\nFor additional information on this flaw, refer to the Knowledgebase\narticle in the References section.\n\nAll jakarta-commons-httpclient users are advised to upgrade to these\nupdated packages, which contain a backported patch to correct this\nissue.", "edition": 12, "enchantments": {"dependencies": {"modified": "2019-01-16T20:19:40", "references": [{"idList": ["SOL15737", "F5:K15364328", "SOL15364328"], "type": "f5"}, {"idList": ["ATLASSIAN:CWD-4355"], "type": "atlassian"}, {"idList": ["CESA-2014:1146", "CESA-2014:1166"], "type": "centos"}, {"idList": ["CVE-2014-3577"], "type": "cve"}, {"idList": ["DEBIAN:DLA-222-1:38FAF"], "type": "debian"}, {"idList": ["ELSA-2014-1166", "ELSA-2014-1146"], "type": "oraclelinux"}, {"idList": ["SECURITYVULNS:DOC:32573", "SECURITYVULNS:DOC:31006", "SECURITYVULNS:VULN:13923"], "type": "securityvulns"}, {"idList": ["ORACLE:CPUJUL2018-4258247"], "type": "oracle"}, {"idList": ["ALAS-2014-410"], "type": "amazon"}, {"idList": ["REDHAT-RHSA-2014-1321.NASL", "REDHAT-RHSA-2014-1320.NASL", "CENTOS_RHSA-2014-1146.NASL", "ORACLELINUX_ELSA-2014-1146.NASL", "FREEBSD_PKG_AC18046C9B0811E68011005056925DB4.NASL", "REDHAT-RHSA-2014-1146.NASL", "ORACLELINUX_ELSA-2014-1166.NASL", "REDHAT-RHSA-2014-1833.NASL", "REDHAT-RHSA-2014-1834.NASL", "CENTOS_RHSA-2014-1166.NASL"], "type": "nessus"}, {"idList": ["AC18046C-9B08-11E6-8011-005056925DB4"], "type": "freebsd"}, {"idList": ["OPENVAS:1361412562310123318", "OPENVAS:1361412562310882010", "OPENVAS:1361412562310882002", "OPENVAS:1361412562310123321", "OPENVAS:1361412562310871238", "OPENVAS:1361412562310881999", "OPENVAS:1361412562310871237", "OPENVAS:1361412562310868159", "OPENVAS:1361412562310882000", "OPENVAS:1361412562310106512"], "type": "openvas"}, {"idList": ["USN-2769-1"], "type": "ubuntu"}, {"idList": ["RHSA-2014:1834", "RHSA-2014:1146", "RHSA-2014:1321", "RHSA-2014:1162", "RHSA-2014:2019", "RHSA-2014:1320", "RHSA-2014:1833", "RHSA-2014:1082", "RHSA-2014:1166", "RHSA-2015:0158"], "type": "redhat"}]}, "score": {"value": 5.0, "vector": "NONE"}}, "hash": "cee2083cc12a4efe2830983a6eaa213daa7b604ff18e32d15ce201715af560a1", "hashmap": [{"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "8984f2f517eb84a2f0769be9af3e05ce", "key": "description"}, {"hash": "c8e3454d64838986e9614151dc781f59", "key": "cvelist"}, {"hash": "474125cf5a862fc9b9ffbcfbe9b44ef8", "key": "modified"}, {"hash": "aa48a6bdcab91a600eca490863982fbd", "key": "cvss"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "78b2e633e5971ef3e0e2c3819b1d6709", "key": "cpe"}, {"hash": "e417addab555c2a8899b082952e8abb3", "key": "title"}, {"hash": "7158555fc393f099b668583389d998dc", "key": "href"}, {"hash": "1faab713327e700e42d81a14cb4b60ba", "key": "pluginID"}, {"hash": "5df7238f8549d311d366978ad5e49d1a", "key": "published"}, {"hash": "dd2fc9858f85d86338942c8a8b9c724a", "key": "references"}, {"hash": "b46559ea68ec9a13474c3a7776817cfd", "key": "naslFamily"}, {"hash": "4288681fa1c496db1a3c2d63bfdf733a", "key": "sourceData"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=77567", "id": "REDHAT-RHSA-2014-1166.NASL", "lastseen": "2019-01-16T20:19:40", "modified": "2018-12-27T00:00:00", "naslFamily": "Red Hat Local Security Checks", "objectVersion": "1.3", "pluginID": "77567", "published": "2014-09-09T00:00:00", "references": ["https://access.redhat.com/errata/RHSA-2014:1166", "https://access.redhat.com/security/cve/cve-2014-3577", "https://access.redhat.com/solutions/1165533"], "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2014:1166. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(77567);\n script_version(\"1.15\");\n script_cvs_date(\"Date: 2018/12/27 10:05:36\");\n\n script_cve_id(\"CVE-2014-3577\");\n script_bugtraq_id(69258);\n script_xref(name:\"RHSA\", value:\"2014:1166\");\n\n script_name(english:\"RHEL 5 / 6 / 7 : jakarta-commons-httpclient (RHSA-2014:1166)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated jakarta-commons-httpclient packages that fix one security\nissue are now available for Red Hat Enterprise Linux 5, 6, and 7.\n\nRed Hat Product Security has rated this update as having Important\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available from the\nCVE link in the References section.\n\nJakarta Commons HTTPClient implements the client side of HTTP\nstandards.\n\nIt was discovered that the HTTPClient incorrectly extracted host name\nfrom an X.509 certificate subject's Common Name (CN) field. A\nman-in-the-middle attacker could use this flaw to spoof an SSL server\nusing a specially crafted X.509 certificate. (CVE-2014-3577)\n\nFor additional information on this flaw, refer to the Knowledgebase\narticle in the References section.\n\nAll jakarta-commons-httpclient users are advised to upgrade to these\nupdated packages, which contain a backported patch to correct this\nissue.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/solutions/1165533\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2014:1166\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2014-3577\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient-demo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient-javadoc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient-manual\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:5\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:6.5\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.3\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.5\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.6\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/09/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/09/09\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = eregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^(5|6|7)([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 5.x / 6.x / 7.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2014:1166\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n if (rpm_exists(rpm:\"jakarta-commons-httpclient-3.0-7\", release:\"RHEL5\") && rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"jakarta-commons-httpclient-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_exists(rpm:\"jakarta-commons-httpclient-3.0-7\", release:\"RHEL5\") && rpm_check(release:\"RHEL5\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_exists(rpm:\"jakarta-commons-httpclient-3.0-7\", release:\"RHEL5\") && rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"jakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"jakarta-commons-httpclient-demo-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-demo-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-demo-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"jakarta-commons-httpclient-javadoc-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-javadoc-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-javadoc-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"jakarta-commons-httpclient-manual-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-manual-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-manual-3.0-7jpp.4.el5_10\")) flag++;\n\n\n if (rpm_exists(rpm:\"jakarta-commons-httpclient-3.1-0\", release:\"RHEL6\") && rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"jakarta-commons-httpclient-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_exists(rpm:\"jakarta-commons-httpclient-3.1-0\", release:\"RHEL6\") && rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_exists(rpm:\"jakarta-commons-httpclient-3.1-0\", release:\"RHEL6\") && rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"jakarta-commons-httpclient-debuginfo-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-debuginfo-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-debuginfo-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"jakarta-commons-httpclient-demo-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-demo-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-demo-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"jakarta-commons-httpclient-javadoc-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-javadoc-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-javadoc-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"jakarta-commons-httpclient-manual-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-manual-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-manual-3.1-0.9.el6_5\")) flag++;\n\n\n if (rpm_exists(rpm:\"jakarta-commons-httpclient-3.1-16\", release:\"RHEL7\") && rpm_check(release:\"RHEL7\", reference:\"jakarta-commons-httpclient-3.1-16.el7_0\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", reference:\"jakarta-commons-httpclient-demo-3.1-16.el7_0\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", reference:\"jakarta-commons-httpclient-javadoc-3.1-16.el7_0\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", reference:\"jakarta-commons-httpclient-manual-3.1-16.el7_0\")) flag++;\n\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"jakarta-commons-httpclient / jakarta-commons-httpclient-debuginfo / etc\");\n }\n}\n", "title": "RHEL 5 / 6 / 7 : jakarta-commons-httpclient (RHSA-2014:1166)", "type": "nessus", "viewCount": 3}, "differentElements": ["description"], "edition": 12, "lastseen": "2019-01-16T20:19:40"}, {"bulletin": {"bulletinFamily": "scanner", "cpe": ["cpe:/o:redhat:enterprise_linux:5", "cpe:/o:redhat:enterprise_linux:6.5", "cpe:/o:redhat:enterprise_linux:7.4", "p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient", "cpe:/o:redhat:enterprise_linux:7.5", "cpe:/o:redhat:enterprise_linux:7", "p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient-manual", "cpe:/o:redhat:enterprise_linux:7.3", "cpe:/o:redhat:enterprise_linux:7.6", "cpe:/o:redhat:enterprise_linux:6", "p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient-javadoc", "p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient-debuginfo", "p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient-demo"], "cvelist": ["CVE-2014-3577"], "cvss": {"score": 5.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "description": "Updated jakarta-commons-httpclient packages that fix one security issue are now available for Red Hat Enterprise Linux 5, 6, and 7.\n\nRed Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.\n\nJakarta Commons HTTPClient implements the client side of HTTP standards.\n\nIt was discovered that the HTTPClient incorrectly extracted host name from an X.509 certificate subject's Common Name (CN) field. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate. (CVE-2014-3577)\n\nFor additional information on this flaw, refer to the Knowledgebase article in the References section.\n\nAll jakarta-commons-httpclient users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.", "edition": 10, "enchantments": {"score": {"value": 5.0, "vector": "NONE"}}, "hash": "6a8a26f4db257a226562d45ace1da0a523adc5fb0fac03b9a1553a76cb721598", "hashmap": [{"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "9086335852a7283db58febb65140689b", "key": "description"}, {"hash": "c8e3454d64838986e9614151dc781f59", "key": "cvelist"}, {"hash": "aa48a6bdcab91a600eca490863982fbd", "key": "cvss"}, {"hash": "f71a9310b57e3fbd55f27df0487eecda", "key": "modified"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "78b2e633e5971ef3e0e2c3819b1d6709", "key": "cpe"}, {"hash": "e417addab555c2a8899b082952e8abb3", "key": "title"}, {"hash": "7158555fc393f099b668583389d998dc", "key": "href"}, {"hash": "1faab713327e700e42d81a14cb4b60ba", "key": "pluginID"}, {"hash": "5df7238f8549d311d366978ad5e49d1a", "key": "published"}, {"hash": "dd2fc9858f85d86338942c8a8b9c724a", "key": "references"}, {"hash": "25bc34fd57383c840f5f403c7c439380", "key": "sourceData"}, {"hash": "b46559ea68ec9a13474c3a7776817cfd", "key": "naslFamily"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=77567", "id": "REDHAT-RHSA-2014-1166.NASL", "lastseen": "2018-12-15T03:42:42", "modified": "2018-12-14T00:00:00", "naslFamily": "Red Hat Local Security Checks", "objectVersion": "1.3", "pluginID": "77567", "published": "2014-09-09T00:00:00", "references": ["https://access.redhat.com/errata/RHSA-2014:1166", "https://access.redhat.com/security/cve/cve-2014-3577", "https://access.redhat.com/solutions/1165533"], "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2014:1166. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(77567);\n script_version(\"1.14\");\n script_cvs_date(\"Date: 2018/12/14 9:50:14\");\n\n script_cve_id(\"CVE-2014-3577\");\n script_bugtraq_id(69258);\n script_xref(name:\"RHSA\", value:\"2014:1166\");\n\n script_name(english:\"RHEL 5 / 6 / 7 : jakarta-commons-httpclient (RHSA-2014:1166)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated jakarta-commons-httpclient packages that fix one security\nissue are now available for Red Hat Enterprise Linux 5, 6, and 7.\n\nRed Hat Product Security has rated this update as having Important\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available from the\nCVE link in the References section.\n\nJakarta Commons HTTPClient implements the client side of HTTP\nstandards.\n\nIt was discovered that the HTTPClient incorrectly extracted host name\nfrom an X.509 certificate subject's Common Name (CN) field. A\nman-in-the-middle attacker could use this flaw to spoof an SSL server\nusing a specially crafted X.509 certificate. (CVE-2014-3577)\n\nFor additional information on this flaw, refer to the Knowledgebase\narticle in the References section.\n\nAll jakarta-commons-httpclient users are advised to upgrade to these\nupdated packages, which contain a backported patch to correct this\nissue.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/solutions/1165533\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2014:1166\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2014-3577\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient-demo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient-javadoc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient-manual\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:5\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:6.5\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.3\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.5\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.6\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/09/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/09/09\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = eregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^(5|6|7)([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 5.x / 6.x / 7.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2014:1166\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n if (rpm_exists(rpm:\"jakarta-commons-httpclient-3.0-7\", release:\"RHEL5\") && rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"jakarta-commons-httpclient-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"jakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10\")) flag++;\n\n\n if (rpm_exists(rpm:\"jakarta-commons-httpclient-3.1-0\", release:\"RHEL6\") && rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"jakarta-commons-httpclient-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_exists(rpm:\"jakarta-commons-httpclient-3.1-0\", release:\"RHEL6\") && rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_exists(rpm:\"jakarta-commons-httpclient-3.1-0\", release:\"RHEL6\") && rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"jakarta-commons-httpclient-debuginfo-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-debuginfo-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-debuginfo-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"jakarta-commons-httpclient-demo-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-demo-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-demo-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"jakarta-commons-httpclient-javadoc-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-javadoc-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-javadoc-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"jakarta-commons-httpclient-manual-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-manual-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-manual-3.1-0.9.el6_5\")) flag++;\n\n\n if (rpm_exists(rpm:\"jakarta-commons-httpclient-3.1-16\", release:\"RHEL7\") && rpm_check(release:\"RHEL7\", reference:\"jakarta-commons-httpclient-3.1-16.el7_0\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", reference:\"jakarta-commons-httpclient-demo-3.1-16.el7_0\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", reference:\"jakarta-commons-httpclient-javadoc-3.1-16.el7_0\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", reference:\"jakarta-commons-httpclient-manual-3.1-16.el7_0\")) flag++;\n\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"jakarta-commons-httpclient / jakarta-commons-httpclient-debuginfo / etc\");\n }\n}\n", "title": "RHEL 5 / 6 / 7 : jakarta-commons-httpclient (RHSA-2014:1166)", "type": "nessus", "viewCount": 3}, "differentElements": ["modified", "sourceData"], "edition": 10, "lastseen": "2018-12-15T03:42:42"}], "edition": 15, "hashmap": [{"key": "bulletinFamily", "hash": "bbdaea376f500d25f6b0c1050311dd07"}, {"key": "cpe", "hash": "cd6bdc0033f1c8423017e14954971fe2"}, {"key": "cvelist", "hash": "c8e3454d64838986e9614151dc781f59"}, {"key": "cvss", "hash": "c3c91421e192e0e8141c03da51a74b99"}, {"key": "description", "hash": "44b4ddcd5efd170dee3d948c929fd264"}, {"key": "href", "hash": "fe0021c9f64646252fc8c9f8d8b657e4"}, {"key": "modified", "hash": "abcf9266f425f12dda38f529cd4a94bc"}, {"key": "naslFamily", "hash": "b46559ea68ec9a13474c3a7776817cfd"}, {"key": "pluginID", "hash": "1faab713327e700e42d81a14cb4b60ba"}, {"key": "published", "hash": "5df7238f8549d311d366978ad5e49d1a"}, {"key": "references", "hash": "dd2fc9858f85d86338942c8a8b9c724a"}, {"key": "reporter", "hash": "0fb1014b4614192eebbaf69393c57e18"}, {"key": "sourceData", "hash": "488b1917e9a66426ef13edb42cef1116"}, {"key": "title", "hash": "e417addab555c2a8899b082952e8abb3"}, {"key": "type", "hash": "5e0bd03bec244039678f2b955a2595aa"}], "hash": "ade8d8c08b69d36b549678d32c18ccd45420baf3d1e7cb75bbf86c0de690dd2a", "viewCount": 3, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2014-3577"]}, {"type": "f5", "idList": ["SOL15737", "SOL15364328", "F5:K15364328"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:DOC:31006", "SECURITYVULNS:VULN:13923", "SECURITYVULNS:DOC:32573"]}, {"type": "atlassian", "idList": ["ATLASSIAN:CWD-4355"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310123318", "OPENVAS:1361412562310123321", "OPENVAS:1361412562310882010", "OPENVAS:1361412562310871237", "OPENVAS:1361412562310868159", "OPENVAS:1361412562310871238", "OPENVAS:1361412562310106512", "OPENVAS:1361412562310882002", "OPENVAS:1361412562310882000", "OPENVAS:1361412562310881999"]}, {"type": "redhat", "idList": ["RHSA-2014:1146", "RHSA-2014:1166", "RHSA-2014:1834", "RHSA-2014:1833", "RHSA-2014:1082", "RHSA-2014:1892", "RHSA-2016:1931", "RHSA-2014:1891", "RHSA-2014:1320", "RHSA-2014:1321"]}, {"type": "nessus", "idList": ["ORACLELINUX_ELSA-2014-1146.NASL", "CENTOS_RHSA-2014-1146.NASL", "CENTOS_RHSA-2014-1166.NASL", "ORACLELINUX_ELSA-2014-1166.NASL", "REDHAT-RHSA-2014-1146.NASL", "FEDORA_2014-9617.NASL", "REDHAT-RHSA-2014-1834.NASL", "FREEBSD_PKG_AC18046C9B0811E68011005056925DB4.NASL", "REDHAT-RHSA-2014-1833.NASL", "FEDORA_2014-9629.NASL"]}, {"type": "oraclelinux", "idList": ["ELSA-2014-1166", "ELSA-2014-1146"]}, {"type": "centos", "idList": ["CESA-2014:1166", "CESA-2014:1146"]}, {"type": "freebsd", "idList": ["AC18046C-9B08-11E6-8011-005056925DB4"]}, {"type": "debian", "idList": ["DEBIAN:DLA-222-1:38FAF"]}, {"type": "amazon", "idList": ["ALAS-2014-410"]}, {"type": "ubuntu", "idList": ["USN-2769-1"]}, {"type": "oracle", "idList": ["ORACLE:CPUJUL2018-4258247"]}], "modified": "2019-11-01T03:20:53"}, "score": {"value": 5.9, "vector": "NONE", "modified": "2019-11-01T03:20:53"}, "vulnersScore": 5.9}, "objectVersion": "1.3", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2014:1166. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(77567);\n script_version(\"1.19\");\n script_cvs_date(\"Date: 2019/10/24 15:35:38\");\n\n script_cve_id(\"CVE-2014-3577\");\n script_bugtraq_id(69258);\n script_xref(name:\"RHSA\", value:\"2014:1166\");\n\n script_name(english:\"RHEL 5 / 6 / 7 : jakarta-commons-httpclient (RHSA-2014:1166)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated jakarta-commons-httpclient packages that fix one security\nissue are now available for Red Hat Enterprise Linux 5, 6, and 7.\n\nRed Hat Product Security has rated this update as having Important\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available from the\nCVE link in the References section.\n\nJakarta Commons HTTPClient implements the client side of HTTP\nstandards.\n\nIt was discovered that the HTTPClient incorrectly extracted host name\nfrom an X.509 certificate subject's Common Name (CN) field. A\nman-in-the-middle attacker could use this flaw to spoof an SSL server\nusing a specially crafted X.509 certificate. (CVE-2014-3577)\n\nFor additional information on this flaw, refer to the Knowledgebase\narticle in the References section.\n\nAll jakarta-commons-httpclient users are advised to upgrade to these\nupdated packages, which contain a backported patch to correct this\nissue.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/solutions/1165533\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2014:1166\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2014-3577\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient-demo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient-javadoc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient-manual\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:5\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:6.5\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.3\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.5\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.7\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2014/08/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/09/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/09/09\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(5|6|7)([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 5.x / 6.x / 7.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2014:1166\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n if (rpm_exists(rpm:\"jakarta-commons-httpclient-3.0-7\", release:\"RHEL5\") && rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"jakarta-commons-httpclient-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_exists(rpm:\"jakarta-commons-httpclient-3.0-7\", release:\"RHEL5\") && rpm_check(release:\"RHEL5\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_exists(rpm:\"jakarta-commons-httpclient-3.0-7\", release:\"RHEL5\") && rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"jakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"jakarta-commons-httpclient-demo-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-demo-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-demo-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"jakarta-commons-httpclient-javadoc-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-javadoc-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-javadoc-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"jakarta-commons-httpclient-manual-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-manual-3.0-7jpp.4.el5_10\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-manual-3.0-7jpp.4.el5_10\")) flag++;\n\n\n if (rpm_exists(rpm:\"jakarta-commons-httpclient-3.1-0\", release:\"RHEL6\") && rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"jakarta-commons-httpclient-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_exists(rpm:\"jakarta-commons-httpclient-3.1-0\", release:\"RHEL6\") && rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_exists(rpm:\"jakarta-commons-httpclient-3.1-0\", release:\"RHEL6\") && rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"jakarta-commons-httpclient-debuginfo-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-debuginfo-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-debuginfo-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"jakarta-commons-httpclient-demo-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-demo-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-demo-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"jakarta-commons-httpclient-javadoc-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-javadoc-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-javadoc-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"jakarta-commons-httpclient-manual-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"jakarta-commons-httpclient-manual-3.1-0.9.el6_5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-manual-3.1-0.9.el6_5\")) flag++;\n\n\n if (rpm_exists(rpm:\"jakarta-commons-httpclient-3.1-16\", release:\"RHEL7\") && rpm_check(release:\"RHEL7\", reference:\"jakarta-commons-httpclient-3.1-16.el7_0\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", reference:\"jakarta-commons-httpclient-demo-3.1-16.el7_0\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", reference:\"jakarta-commons-httpclient-javadoc-3.1-16.el7_0\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", reference:\"jakarta-commons-httpclient-manual-3.1-16.el7_0\")) flag++;\n\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"jakarta-commons-httpclient / jakarta-commons-httpclient-debuginfo / etc\");\n }\n}\n", "naslFamily": "Red Hat Local Security Checks", "pluginID": "77567", "cpe": ["cpe:/o:redhat:enterprise_linux:5", "cpe:/o:redhat:enterprise_linux:6.5", "cpe:/o:redhat:enterprise_linux:7.4", "cpe:/o:redhat:enterprise_linux:7.7", "p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient", "cpe:/o:redhat:enterprise_linux:7.5", "cpe:/o:redhat:enterprise_linux:7", "p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient-manual", "cpe:/o:redhat:enterprise_linux:7.3", "cpe:/o:redhat:enterprise_linux:7.6", "cpe:/o:redhat:enterprise_linux:6", "p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient-javadoc", "p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient-debuginfo", "p-cpe:/a:redhat:enterprise_linux:jakarta-commons-httpclient-demo"], "scheme": null}

{"cve": [{"lastseen": "2019-10-23T12:17:49", "bulletinFamily": "NVD", "description": "org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a \"CN=\" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the \"foo,CN=www.apache.org\" string in the O field.\n<a href=\"http://cwe.mitre.org/data/definitions/297.html\" rel=\"nofollow\">CWE-297: Improper Validation of Certificate with Host Mismatch</a>", "modified": "2018-07-19T01:29:00", "id": "CVE-2014-3577", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3577", "published": "2014-08-21T14:55:00", "title": "CVE-2014-3577", "type": "cve", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}], "f5": [{"lastseen": "2016-09-26T17:23:12", "bulletinFamily": "software", "description": "org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a \"CN=\" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the \"foo,CN=www.apache.org\" string in the O field. ([CVE-2014-3577](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3577>)) \n\n", "modified": "2014-10-23T00:00:00", "published": "2014-10-23T00:00:00", "href": "http://support.f5.com/kb/en-us/solutions/public/15000/700/sol15737.html", "id": "SOL15737", "title": "SOL15737 - Apache vulnerability CVE-2014-3577", "type": "f5", "cvss": {"score": 5.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}}, {"lastseen": "2016-09-26T17:23:09", "bulletinFamily": "software", "description": "Vulnerability Recommended Actions\n\nNone\n\nSupplemental Information\n\n * SOL9970: Subscribing to email notifications regarding F5 products\n * SOL9957: Creating a custom RSS feed to view new and updated documents\n * SOL4602: Overview of the F5 security vulnerability response policy\n * SOL4918: Overview of the F5 critical issue hotfix policy\n", "modified": "2016-02-02T00:00:00", "published": "2016-02-02T00:00:00", "id": "SOL15364328", "href": "http://support.f5.com/kb/en-us/solutions/public/k/15/sol15364328.html", "type": "f5", "title": "SOL15364328 - Apache vulnerabilities CVE-2012-5783, CVE-2012-6153, and CVE-2014-3577", "cvss": {"score": 5.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}}, {"lastseen": "2017-06-08T00:16:21", "bulletinFamily": "software", "description": "\nF5 Product Development has evaluated the currently supported releases for potential vulnerability.\n\nTo determine if your release is known to be vulnerable, the components or features that are affected by the vulnerability, and for information about releases or hotfixes that address the vulnerability, refer to the following table:\n\nProduct| Versions known to be vulnerable| Versions known to be not vulnerable| Severity| Vulnerable component or feature \n---|---|---|---|--- \nBIG-IP LTM| None| 12.0.0 \n11.0.0 - 11.6.0 \n10.1.0 - 10.2.4| Not vulnerable| None \nBIG-IP AAM| None| 12.0.0 \n11.4.0 - 11.6.0| Not vulnerable| None \nBIG-IP AFM| None| 12.0.0 \n11.3.0 - 11.6.0| Not vulnerable| None \nBIG-IP Analytics| None| 12.0.0 \n11.0.0 - 11.6.0| Not vulnerable| None \nBIG-IP APM| None| 12.0.0 \n11.0.0 - 11.6.0 \n10.1.0 - 10.2.4| Not vulnerable| None \nBIG-IP ASM| None| 12.0.0 \n11.0.0 - 11.6.0 \n10.1.0 - 10.2.4| Not vulnerable| None \nBIG-IP DNS| None| 12.0.0| Not vulnerable| None \nBIG-IP Edge Gateway| None| 11.0.0 - 11.3.0 \n10.1.0 - 10.2.4| Not vulnerable| None \nBIG-IP GTM| None| 11.0.0 - 11.6.0 \n10.1.0 - 10.2.4| Not vulnerable| None \nBIG-IP Link Controller| None| 12.0.0 \n11.0.0 - 11.6.0 \n10.1.0 - 10.2.4| Not vulnerable| None \nBIG-IP PEM| None| 12.0.0 \n11.3.0 - 11.6.0| Not vulnerable| None \nBIG-IP PSM| None| 11.0.0 - 11.4.1 \n10.1.0 - 10.2.4| Not vulnerable| None \nBIG-IP WebAccelerator| None| 11.0.0 - 11.3.0 \n10.1.0 - 10.2.4| Not vulnerable| None \nBIG-IP WOM| None| 11.0.0 - 11.3.0 \n10.1.0 - 10.2.4| Not vulnerable| None \nARX| None| 6.0.0 - 6.4.0| Not vulnerable| None \nEnterprise Manager| None| 3.0.0 - 3.1.1| Not vulnerable| None \nFirePass| None| 7.0.0 \n6.0.0 - 6.1.0| Not vulnerable| None \nBIG-IQ Cloud| None| 4.0.0 - 4.5.0| Not vulnerable| None \nBIG-IQ Device| None| 4.2.0 - 4.5.0| Not vulnerable| None \nBIG-IQ Security| None| 4.0.0 - 4.5.0| Not vulnerable| None \nBIG-IQ ADC| None| 4.5.0| Not vulnerable| None \nBIG-IQ Centralized Management| None| 4.6.0| Not vulnerable| None \nBIG-IQ Cloud and Orchestration| None| 1.0.0| Not vulnerable| None \nLineRate| None| 2.5.0 - 2.6.1| Not vulnerable| None \nF5 WebSafe| None| 1.0.0| Not vulnerable| None \nTraffix SDC| None| 4.0.0 - 4.4.0 \n3.3.2 - 3.5.1| Not vulnerable| None\n\nNone\n\n * [K9970: Subscribing to email notifications regarding F5 products](<https://support.f5.com/csp/article/K9970>)\n * [K9957: Creating a custom RSS feed to view new and updated documents](<https://support.f5.com/csp/article/K9957>)\n * [K4602: Overview of the F5 security vulnerability response policy](<https://support.f5.com/csp/article/K4602>)\n * [K4918: Overview of the F5 critical issue hotfix policy](<https://support.f5.com/csp/article/K4918>)\n", "modified": "2017-03-13T23:05:00", "published": "2016-02-02T22:55:00", "id": "F5:K15364328", "href": "https://support.f5.com/csp/article/K15364328", "title": "Apache vulnerabilities CVE-2012-5783, CVE-2012-6153, and CVE-2014-3577", "type": "f5", "cvss": {"score": 5.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}}], "securityvulns": [{"lastseen": "2018-08-31T11:10:53", "bulletinFamily": "software", "description": "\r\n\r\n-----BEGIN PGP SIGNED MESSAGE-----\r\nHash: SHA1\r\n\r\n Security Advisory - Apache Software Foundation\r\n Apache HttpComponents / hc.apache.org\r\n\r\n Hostname verification susceptible to MITM attack\r\n\r\n CVE-2014-3577 / CVSS 1.4\r\n\r\nApache HttpComponents &#40;prior to revision 4.3.5/4.0.2&#41; may be susceptible \r\nto a &#39;Man in the Middle Attack&#39; due to a flaw in the default hostname \r\nverification during SSL/TLS when a specially crafted server side \r\ncertificate is used.\r\n\r\nBackground\r\n- ----------\r\n\r\nDuring an SSL connection &#40;https&#41; the client verifies the hostname in \r\nthe URL against the hostname as encoded in the servers certificate &#40;CN,\r\nsubjectAlt fields&#41;. This is to ensure that the client connects to the\r\n&#39;real&#39; server, as opposed to something in middle &#40;man in the middle&#41;\r\nthat may compromise end to end confidentiality and integrity.\r\n\r\nDetails\r\n- -------\r\n\r\nThe flaw is in the default Apache HttpComponents \r\n\r\n org.apache.http.conn.ssl.AbstractVerifier \r\n\r\nthat is used in client mode for verification of hostname of the server\r\nside certificate. It parsed the entire subject distinguished name &#40;DN&#41;\r\nfor the occurrence of any &lt;CN=&gt; substring &#40;regardles of field&#41;.\r\n\r\nTherefore a DN of with a O field such as\r\n\r\n O=&quot;foo,CN=www.apache.org\u201d \r\n\r\nand a CN of &quot;www.evil.org\u201d and ordered such that the O appears prior to\r\nthe CN field would incorrectly match match on the &lt;www.apache.org&gt; in\r\nthe O field as opposed to just the values in the CN and alternative\r\nsubject name&#40;s&#41;. \r\n\r\nThe doctored field can be any field but the CN field itself; including \r\nthe &lt;E&gt; or emailAddress field as long as it appears before the CN &#40;some \r\nCAs reorder the DN&#41;.\r\n\r\nA third party in posession of such a doctored certificate and who also\r\nhas the ability to intercept or reroute the traffic to a https server\r\nunder its control &#40;e.g. through DNS doctoring or various forms of\r\ntraffic rerouting or spoofing&#41; can thus perform a &#39;man in the middle&#39;\r\nattack and compromise end to end confidentiality and integrety.\r\n\r\nNote that while some certificate authorities may be relatively strict\r\non what they allow in the various fields - most are NOT; and allow \r\nfor a relatively large amount of leeway in, for example, the OU \r\nand E fields.\r\n\r\nImpact:\r\n- -------\r\n\r\nA man-in-the-middle can interpose itself between the server and the\r\ncode using an affected version of Apache HttpComponents as a client.\r\n\r\nLeading to complete loss of end to end confidentiality and end to \r\nend integrety of the connection.\r\n\r\nVersions affected: \r\n- ------------------\r\nAll versions prior to HttpClient 4.3.5 &#40;including the Android port&#41; \r\nand HttpAsyncClient 4.0.2. The fix was introduced in these versions.\r\n\r\nhttp://search.maven.org/#artifactdetails|org.apache.httpcomponents|\r\nhttpclient|4.3.5|jar\r\nhttp://search.maven.org/#artifactdetails|org.apache.httpcomponents|\r\nhttpasyncclient|4.0.2|jar\r\n\r\nThese have been silently pushed out to Maven central and Apache Dist \r\nas of 2014-08-1. An Android build was released on 2014-08-15.\r\n\r\nResolution\r\n- ----------\r\n\r\nA fix has been applied as of revision 1614065 and is part of release \r\nHttpClient 4.3.5 &#40;including HttpClient port for Android against the\r\nofficial Google Android SDK&#41;and HttpClient &#40;async&#41; 4.0.2.\r\n\r\nUpgrading to these versions newer resolves this issue.\r\n\r\nMitigations and work arounds\r\n- ----------------------------\r\n\r\nIf upgrading to version 4.3.5/4.0.2 is not an option; one could change \r\nthe default org.apache.http.conn.ssl.AbstractVerifier of earlier \r\nversions for revision 1614065 of newer.\r\n\r\nNote that exploitation of this flaw also requires some level of DNS or\r\nIP spoofing &#40;or existing &#39;in the middle infrastructure&#39; such as a corporate\r\nproxy or other TCP level equipment en-route&#41;. This need may allow for site \r\nspecific alternative mitigations.\r\n\r\nReproducing the flaw\r\n- --------------------\r\n\r\nIf so required; the following statements will allow the testing of a\r\nApache HttpComponents client against a server with a thus crafted\r\ncertificate:\r\n\r\n openssl req -new -x509 -keyout /dev/stdout &#92;\r\n -subj &quot;/O=foo, CN=www.apache.org/CN=machine-domain-name/&quot; &#92;\r\n -set_serial 86653 -nodes |&#92;\r\n openssl s_server -cert /dev/stdin -accept 8443 -www\r\n\r\nand a Apache HttpComponents client that connects to\r\n&quot;https://www.apache.org:8443/&quot; with the DNS entry for www.apache.org\r\npointing to the machine-domain-name.\r\n\r\nCredits and timeline\r\n- --------------------\r\n\r\nThe flaw was found and reported by Subodh Iyengar &lt;http://www.subodh.io&gt;,\r\nand Will Shackleton &lt;http://www.shackleton.io/&gt; from Facebook. It was\r\nreported on the 23rd of July. A fix was applied by and released on \r\n2014-08-01. An Android build was released on the 2014-08-15. This \r\nsecurity advisory fully discloses the issue and current insights known \r\nto the Apache Software foundation &#40;the vendor&#41;.\r\n\r\nApache would like to thank all involved for their help with this.\r\n\r\nA similar issue was reported by Florian Weimer of Red Hat in 2012 and \r\nwas fixed by https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=692442#56.\r\nIt has now been assigned CVE-2012-6153.\r\n\r\n\r\nCommon Vulnerability Scoring &#40;Version 2&#41; and vector\r\n- ---------------------------------------------------\r\n\r\nCVSS Base Score 5.8\r\nImpact Subscore 4.9\r\nExploitability Subscore 8.6\r\nCVSS Temporal Score 4.8\r\nCVSS Environmental Score 1.4\r\nModified Impact Subscore 5.2\r\n ------------------------------\r\n Overall CVSS Score 1.4\r\n\r\nCVSS v2 Vector \r\n AV:N/AC:M/Au:N/C:P/I:N/A:P/E:F/RL:OF/RC:C/CDP:L/TD:L/CR:H/IR:L/AR:L\r\n\r\n1.09 / : 1692 $\r\n-----BEGIN PGP SIGNATURE-----\r\nVersion: GnuPG v1.4\r\nComment: This message is encrypted and/or signed with PGP &#40;gnu-pg, gpg&#41;. Contact dirkx@webweaving.org if you cannot read it.\r\n\r\niQCVAwUBU/IEdzGmPZbsFAuBAQJsMgP+OLy4aCc2fGclwnkepigGonCHnRn7S+c9\r\nJ3xG7kiexDjOfbds+2i8iOEcc1pCbXgUvSNH4kBuY0aYfUf55Ofg8OXMOKHxT+/Q\r\niGB78bbg+4IJ4+zIJzqxe0wJl0LBnXiB1vcEIp64YoLttfLqoAPqKyQl84eLogj/\r\nzzrEFR2GyVU=\r\n=XQZm\r\n-----END PGP SIGNATURE-----\r\n\r\n", "modified": "2014-08-18T00:00:00", "published": "2014-08-18T00:00:00", "id": "SECURITYVULNS:DOC:31006", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:31006", "title": "CVE-2014-3577: Apache HttpComponents client: Hostname verification susceptible to MITM attack", "type": "securityvulns", "cvss": {"score": 5.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}}, {"lastseen": "2018-08-31T11:09:56", "bulletinFamily": "software", "description": "Validation bypass via malcrafted constructions like O=&quot;foo,CN=www.apache.org\u201d", "modified": "2014-08-18T00:00:00", "published": "2014-08-18T00:00:00", "id": "SECURITYVULNS:VULN:13923", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:13923", "title": "Apache HttpClient certificate checking bypass", "type": "securityvulns", "cvss": {"score": 5.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}}, {"lastseen": "2018-08-31T11:11:02", "bulletinFamily": "software", "description": "\r\n\r\n==========================================================================\r\nUbuntu Security Notice USN-2769-1\r\nOctober 14, 2015\r\n\r\ncommons-httpclient vulnerabilities\r\n==========================================================================\r\n\r\nA security issue affects these releases of Ubuntu and its derivatives:\r\n\r\n- Ubuntu 15.04\r\n- Ubuntu 14.04 LTS\r\n- Ubuntu 12.04 LTS\r\n\r\nSummary:\r\n\r\nSeveral security issues were fixed in commons-httpclient.\r\n\r\nSoftware Description:\r\n- commons-httpclient: A Java&#40;TM&#41; library for creating HTTP clients\r\n\r\nDetails:\r\n\r\nIt was discovered that Apache Commons HttpClient did not properly verify the\r\nCommon Name or subjectAltName fields of X.509 certificates. An attacker could\r\nexploit this to perform a man in the middle attack to view sensitive\r\ninformation or alter encrypted communications. This issue only affected Ubuntu\r\n12.04 LTS. &#40;CVE-2012-5783&#41;\r\n\r\nFlorian Weimer discovered the fix for CVE-2012-5783 was incomplete for Apache\r\nCommons HttpClient. An attacker could exploit this to perform a man in the\r\nmiddle attack to view sensitive information or alter encrypted communications.\r\nThis issue only affected Ubuntu 12.04 LTS. &#40;CVE-2012-6153&#41;\r\n\r\nSubodh Iyengar and Will Shackleton discovered the fix for CVE-2012-5783 was\r\nincomplete for Apache Commons HttpClient. An attacker could exploit this to\r\nperform a man in the middle attack to view sensitive information or alter\r\nencrypted communications. &#40;CVE-2014-3577&#41;\r\n\r\nIt was discovered that Apache Commons HttpClient did not properly handle read\r\ntimeouts during HTTPS handshakes. A remote attacker could trigger this flaw to\r\ncause a denial of service. &#40;CVE-2015-5262&#41;\r\n\r\nUpdate instructions:\r\n\r\nThe problem can be corrected by updating your system to the following\r\npackage versions:\r\n\r\nUbuntu 15.04:\r\n libcommons-httpclient-java 3.1-10.2ubuntu0.15.04.1\r\n\r\nUbuntu 14.04 LTS:\r\n libcommons-httpclient-java 3.1-10.2ubuntu0.14.04.1\r\n\r\nUbuntu 12.04 LTS:\r\n libcommons-httpclient-java 3.1-10ubuntu0.1\r\n\r\nIn general, a standard system update will make all the necessary changes.\r\n\r\nReferences:\r\n http://www.ubuntu.com/usn/usn-2769-1\r\n CVE-2012-5783, CVE-2012-6153, CVE-2014-3577, CVE-2015-5262\r\n\r\nPackage Information:\r\n https://launchpad.net/ubuntu/+source/commons-httpclient/3.1-10.2ubuntu0.15.04.1\r\n https://launchpad.net/ubuntu/+source/commons-httpclient/3.1-10.2ubuntu0.14.04.1\r\n https://launchpad.net/ubuntu/+source/commons-httpclient/3.1-10ubuntu0.1\r\n\r\n\r\n\r\n-- \r\nubuntu-security-announce mailing list\r\nubuntu-security-announce@lists.ubuntu.com\r\nModify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce\r\n\r\n", "modified": "2015-10-25T00:00:00", "published": "2015-10-25T00:00:00", "id": "SECURITYVULNS:DOC:32573", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:32573", "title": "[USN-2769-1] Apache Commons HttpClient", "type": "securityvulns", "cvss": {"score": 5.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}}], "atlassian": [{"lastseen": "2019-08-15T10:42:38", "bulletinFamily": "software", "description": "Upgrade commons-httpclient to version {{3.1-atlassian-2}} to gain SNI support and to fix CVE-2012-5783 & CVE-2014-3577.", "modified": "2019-08-15T07:04:52", "published": "2015-05-12T07:34:43", "id": "ATLASSIAN:CWD-4355", "href": "https://jira.atlassian.com/browse/CWD-4355", "title": "Update the version of commons-httpclient to address CVE-2012-5783 & CVE-2014-3577 and gain SNI support", "type": "atlassian", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}], "openvas": [{"lastseen": "2019-05-29T18:35:54", "bulletinFamily": "scanner", "description": "Oracle Linux Local Security Checks ELSA-2014-1146", "modified": "2018-09-28T00:00:00", "published": "2015-10-06T00:00:00", "id": "OPENVAS:1361412562310123321", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310123321", "title": "Oracle Linux Local Check: ELSA-2014-1146", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: ELSA-2014-1146.nasl 11688 2018-09-28 13:36:28Z cfischer $\n#\n# Oracle Linux Local Check\n#\n# Authors:\n# Eero Volotinen <eero.volotinen@solinor.com>\n#\n# Copyright:\n# Copyright (c) 2015 Eero Volotinen, http://solinor.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.123321\");\n script_version(\"$Revision: 11688 $\");\n script_tag(name:\"creation_date\", value:\"2015-10-06 14:02:15 +0300 (Tue, 06 Oct 2015)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-09-28 15:36:28 +0200 (Fri, 28 Sep 2018) $\");\n script_name(\"Oracle Linux Local Check: ELSA-2014-1146\");\n script_tag(name:\"insight\", value:\"ELSA-2014-1146 - httpcomponents-client security update. Please see the references for more insight.\");\n script_tag(name:\"solution\", value:\"Update the affected packages to the latest available version.\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"summary\", value:\"Oracle Linux Local Security Checks ELSA-2014-1146\");\n script_xref(name:\"URL\", value:\"http://linux.oracle.com/errata/ELSA-2014-1146.html\");\n script_cve_id(\"CVE-2014-3577\");\n script_tag(name:\"cvss_base\", value:\"5.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/oracle_linux\", \"ssh/login/release\", re:\"ssh/login/release=OracleLinux7\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Eero Volotinen\");\n script_family(\"Oracle Linux Local Security Checks\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\n\nres = \"\";\n\nif(release == \"OracleLinux7\")\n{\n if ((res = isrpmvuln(pkg:\"httpcomponents-client\", rpm:\"httpcomponents-client~4.2.5~5.el7_0\", rls:\"OracleLinux7\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"httpcomponents-client-javadoc\", rpm:\"httpcomponents-client-javadoc~4.2.5~5.el7_0\", rls:\"OracleLinux7\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n\n}\nif (__pkg_match) exit(99);\n exit(0);\n\n", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2019-05-29T18:36:29", "bulletinFamily": "scanner", "description": "Oracle Linux Local Security Checks ELSA-2014-1166", "modified": "2018-09-28T00:00:00", "published": "2015-10-06T00:00:00", "id": "OPENVAS:1361412562310123318", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310123318", "title": "Oracle Linux Local Check: ELSA-2014-1166", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: ELSA-2014-1166.nasl 11688 2018-09-28 13:36:28Z cfischer $\n#\n# Oracle Linux Local Check\n#\n# Authors:\n# Eero Volotinen <eero.volotinen@solinor.com>\n#\n# Copyright:\n# Copyright (c) 2015 Eero Volotinen, http://solinor.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.123318\");\n script_version(\"$Revision: 11688 $\");\n script_tag(name:\"creation_date\", value:\"2015-10-06 14:02:12 +0300 (Tue, 06 Oct 2015)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-09-28 15:36:28 +0200 (Fri, 28 Sep 2018) $\");\n script_name(\"Oracle Linux Local Check: ELSA-2014-1166\");\n script_tag(name:\"insight\", value:\"ELSA-2014-1166 - jakarta-commons-httpclient security update. Please see the references for more insight.\");\n script_tag(name:\"solution\", value:\"Update the affected packages to the latest available version.\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"summary\", value:\"Oracle Linux Local Security Checks ELSA-2014-1166\");\n script_xref(name:\"URL\", value:\"http://linux.oracle.com/errata/ELSA-2014-1166.html\");\n script_cve_id(\"CVE-2014-3577\");\n script_tag(name:\"cvss_base\", value:\"5.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/oracle_linux\", \"ssh/login/release\", re:\"ssh/login/release=OracleLinux(7|5|6)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Eero Volotinen\");\n script_family(\"Oracle Linux Local Security Checks\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\n\nres = \"\";\n\nif(release == \"OracleLinux7\")\n{\n if ((res = isrpmvuln(pkg:\"jakarta-commons-httpclient\", rpm:\"jakarta-commons-httpclient~3.1~16.el7_0\", rls:\"OracleLinux7\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"jakarta-commons-httpclient-demo\", rpm:\"jakarta-commons-httpclient-demo~3.1~16.el7_0\", rls:\"OracleLinux7\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"jakarta-commons-httpclient-javadoc\", rpm:\"jakarta-commons-httpclient-javadoc~3.1~16.el7_0\", rls:\"OracleLinux7\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"jakarta-commons-httpclient-manual\", rpm:\"jakarta-commons-httpclient-manual~3.1~16.el7_0\", rls:\"OracleLinux7\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n\n}\nif(release == \"OracleLinux5\")\n{\n if ((res = isrpmvuln(pkg:\"jakarta-commons-httpclient\", rpm:\"jakarta-commons-httpclient~3.0~7jpp.4.el5_10\", rls:\"OracleLinux5\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"jakarta-commons-httpclient-demo\", rpm:\"jakarta-commons-httpclient-demo~3.0~7jpp.4.el5_10\", rls:\"OracleLinux5\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"jakarta-commons-httpclient-javadoc\", rpm:\"jakarta-commons-httpclient-javadoc~3.0~7jpp.4.el5_10\", rls:\"OracleLinux5\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"jakarta-commons-httpclient-manual\", rpm:\"jakarta-commons-httpclient-manual~3.0~7jpp.4.el5_10\", rls:\"OracleLinux5\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n\n}\nif(release == \"OracleLinux6\")\n{\n if ((res = isrpmvuln(pkg:\"jakarta-commons-httpclient\", rpm:\"jakarta-commons-httpclient~3.1~0.9.el6_5\", rls:\"OracleLinux6\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"jakarta-commons-httpclient-demo\", rpm:\"jakarta-commons-httpclient-demo~3.1~0.9.el6_5\", rls:\"OracleLinux6\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"jakarta-commons-httpclient-javadoc\", rpm:\"jakarta-commons-httpclient-javadoc~3.1~0.9.el6_5\", rls:\"OracleLinux6\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"jakarta-commons-httpclient-manual\", rpm:\"jakarta-commons-httpclient-manual~3.1~0.9.el6_5\", rls:\"OracleLinux6\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n\n}\nif (__pkg_match) exit(99);\n exit(0);\n\n", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2019-05-29T18:37:31", "bulletinFamily": "scanner", "description": "The remote host is missing an update for the ", "modified": "2018-11-23T00:00:00", "published": "2014-09-04T00:00:00", "id": "OPENVAS:1361412562310871237", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310871237", "title": "RedHat Update for httpcomponents-client RHSA-2014:1146-01", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# RedHat Update for httpcomponents-client RHSA-2014:1146-01\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2014 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.871237\");\n script_version(\"$Revision: 12497 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-11-23 09:28:21 +0100 (Fri, 23 Nov 2018) $\");\n script_tag(name:\"creation_date\", value:\"2014-09-04 05:57:20 +0200 (Thu, 04 Sep 2014)\");\n script_cve_id(\"CVE-2014-3577\", \"CVE-2012-6153\");\n script_tag(name:\"cvss_base\", value:\"5.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_name(\"RedHat Update for httpcomponents-client RHSA-2014:1146-01\");\n script_tag(name:\"insight\", value:\"HttpClient is an HTTP/1.1 compliant HTTP agent implementation based on\nhttpcomponents HttpCore.\n\nIt was discovered that the HttpClient incorrectly extracted host name from\nan X.509 certificate subject's Common Name (CN) field. A man-in-the-middle\nattacker could use this flaw to spoof an SSL server using a specially\ncrafted X.509 certificate. (CVE-2014-3577)\n\nFor additional information on this flaw, refer to the Knowledgebase\narticle in the References section.\n\nAll httpcomponents-client users are advised to upgrade to these updated\npackages, which contain a backported patch to correct this issue.\");\n script_tag(name:\"affected\", value:\"httpcomponents-client on Red Hat Enterprise Linux Server (v. 7)\");\n script_tag(name:\"solution\", value:\"Please Install the Updated Packages.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_xref(name:\"RHSA\", value:\"2014:1146-01\");\n script_xref(name:\"URL\", value:\"https://www.redhat.com/archives/rhsa-announce/2014-September/msg00009.html\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'httpcomponents-client'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2014 Greenbone Networks GmbH\");\n script_family(\"Red Hat Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/rhel\", \"ssh/login/rpms\", re:\"ssh/login/release=RHENT_7\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\n\nres = \"\";\n\nif(release == \"RHENT_7\")\n{\n\n if ((res = isrpmvuln(pkg:\"httpcomponents-client\", rpm:\"httpcomponents-client~4.2.5~5.el7_0\", rls:\"RHENT_7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2019-05-29T18:37:16", "bulletinFamily": "scanner", "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2014-08-31T00:00:00", "id": "OPENVAS:1361412562310868159", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310868159", "title": "Fedora Update for httpcomponents-client FEDORA-2014-9617", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for httpcomponents-client FEDORA-2014-9617\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2014 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.868159\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2014-08-31 05:53:50 +0200 (Sun, 31 Aug 2014)\");\n script_cve_id(\"CVE-2014-3577\", \"CVE-2012-6153\");\n script_tag(name:\"cvss_base\", value:\"5.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_name(\"Fedora Update for httpcomponents-client FEDORA-2014-9617\");\n script_tag(name:\"affected\", value:\"httpcomponents-client on Fedora 20\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name:\"FEDORA\", value:\"2014-9617\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/pipermail/package-announce/2014-August/137180.html\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'httpcomponents-client'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2014 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC20\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC20\")\n{\n\n if ((res = isrpmvuln(pkg:\"httpcomponents-client\", rpm:\"httpcomponents-client~4.2.5~4.fc20\", rls:\"FC20\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2019-05-29T18:37:45", "bulletinFamily": "scanner", "description": "The remote host is missing an update for the ", "modified": "2018-11-23T00:00:00", "published": "2014-09-09T00:00:00", "id": "OPENVAS:1361412562310871238", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310871238", "title": "RedHat Update for jakarta-commons-httpclient RHSA-2014:1166-01", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# RedHat Update for jakarta-commons-httpclient RHSA-2014:1166-01\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2014 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.871238\");\n script_version(\"$Revision: 12497 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-11-23 09:28:21 +0100 (Fri, 23 Nov 2018) $\");\n script_tag(name:\"creation_date\", value:\"2014-09-09 05:54:36 +0200 (Tue, 09 Sep 2014)\");\n script_cve_id(\"CVE-2014-3577\", \"CVE-2012-6153\");\n script_tag(name:\"cvss_base\", value:\"5.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_name(\"RedHat Update for jakarta-commons-httpclient RHSA-2014:1166-01\");\n script_tag(name:\"insight\", value:\"Jakarta Commons HTTPClient implements the client side of HTTP standards.\n\nIt was discovered that the HTTPClient incorrectly extracted host name from\nan X.509 certificate subject's Common Name (CN) field. A man-in-the-middle\nattacker could use this flaw to spoof an SSL server using a specially\ncrafted X.509 certificate. (CVE-2014-3577)\n\nFor additional information on this flaw, refer to the Knowledgebase\narticle in the References section.\n\nAll jakarta-commons-httpclient users are advised to upgrade to these\nupdated packages, which contain a backported patch to correct this issue.\n\n4. Solution:\n\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\n\n\n1129074 - CVE-2014-3577 Apache HttpComponents client: SSL hostname verification bypass, incomplete CVE-2012-6153 fix\n\n6. Package List:\n\nRed Hat Enterprise Linux Desktop (v. 5 client):\n\nSource:\njakarta-commons-httpclient-3.0-7jpp.4.el5_10.src.rpm\n\ni386:\njakarta-commons-httpclient-3.0-7jpp.4.el5_10.i386.rpm\njakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10.i386.rpm\n\nx86_64:\njakarta-commons-httpclient-3.0-7jpp.4.el5_10.x86_64.rpm\njakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10.x86_64.rpm\n\nRed Hat Enterprise Linux Desktop Workstation (v. 5 client):\n\nSource:\njakarta-commons-httpclient-3.0-7jpp.4.el5_10.src.rpm\n\ni386:\njakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10.i386.rpm\njakarta-commons-httpclient-demo-3.0-7jpp.4.el5_10.i386.rpm\njakarta-commons-httpclient-javadoc-3.0-7jpp.4.el5_10.i386.rpm\njakarta-commons-httpclient-manual-3.0-7jpp.4.el5_10.i386.rpm\n\nx86_64:\njakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10.x86_64.rpm\njakarta-commons-httpclient-demo-3.0-7jpp.4.el5_10.x86_64.rpm\njakarta-commons-httpclient-javadoc-3.0-7jpp.4.el5_10.x86_64.rpm\njakarta-commons-httpclient-manual-3.0-7jpp.4.el5_10.x86_64.rpm\n\nRed Hat Enterprise Linux (v. 5 server):\n\nSource:\njakarta-commons-httpclient-3.0-7jpp.4.el5_10.src.rpm\n\ni386:\njakarta-commons-httpclient-3.0-7jpp.4.el5_10.i386.rpm\njakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_ ...\n\n Description truncated, please see the referenced URL(s) for more information.\");\n script_tag(name:\"affected\", value:\"jakarta-commons-httpclient on Red Hat Enterprise Linux (v. 5 server),\n Red Hat Enterprise Linux Desktop (v. 6),\n Red Hat Enterprise Linux Server (v. 6),\n Red Hat Enterprise Linux Server (v. 7),\n Red Hat Enterprise Linux Workstation (v. 6)\");\n script_tag(name:\"solution\", value:\"Please Install the Updated Packages.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_xref(name:\"RHSA\", value:\"2014:1166-01\");\n script_xref(name:\"URL\", value:\"https://www.redhat.com/archives/rhsa-announce/2014-September/msg00017.html\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'jakarta-commons-httpclient'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2014 Greenbone Networks GmbH\");\n script_family(\"Red Hat Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/rhel\", \"ssh/login/rpms\", re:\"ssh/login/release=RHENT_(7|6|5)\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\n\nres = \"\";\n\nif(release == \"RHENT_7\")\n{\n\n if ((res = isrpmvuln(pkg:\"jakarta-commons-httpclient\", rpm:\"jakarta-commons-httpclient~3.1~16.el7_0\", rls:\"RHENT_7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n\n\nif(release == \"RHENT_6\")\n{\n\n if ((res = isrpmvuln(pkg:\"jakarta-commons-httpclient\", rpm:\"jakarta-commons-httpclient~3.1~0.9.el6_5\", rls:\"RHENT_6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"jakarta-commons-httpclient-debuginfo\", rpm:\"jakarta-commons-httpclient-debuginfo~3.1~0.9.el6_5\", rls:\"RHENT_6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n\n\nif(release == \"RHENT_5\")\n{\n\n if ((res = isrpmvuln(pkg:\"jakarta-commons-httpclient\", rpm:\"jakarta-commons-httpclient~3.0~7jpp.4.el5_10\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"jakarta-commons-httpclient-debuginfo\", rpm:\"jakarta-commons-httpclient-debuginfo~3.0~7jpp.4.el5_10\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"jakarta-commons-httpclient-demo\", rpm:\"jakarta-commons-httpclient-demo~3.0~7jpp.4.el5_10\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"jakarta-commons-httpclient-javadoc\", rpm:\"jakarta-commons-httpclient-javadoc~3.0~7jpp.4.el5_10\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"jakarta-commons-httpclient-manual\", rpm:\"jakarta-commons-httpclient-manual~3.0~7jpp.4.el5_10\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2019-05-29T18:37:14", "bulletinFamily": "scanner", "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2014-09-10T00:00:00", "id": "OPENVAS:1361412562310882010", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310882010", "title": "CentOS Update for jakarta-commons-httpclient CESA-2014:1166 centos7", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# CentOS Update for jakarta-commons-httpclient CESA-2014:1166 centos7\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2014 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.882010\");\n script_version(\"$Revision: 14222 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 13:50:48 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2014-09-10 06:20:19 +0200 (Wed, 10 Sep 2014)\");\n script_cve_id(\"CVE-2014-3577\", \"CVE-2012-6153\");\n script_tag(name:\"cvss_base\", value:\"5.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_name(\"CentOS Update for jakarta-commons-httpclient CESA-2014:1166 centos7\");\n script_tag(name:\"insight\", value:\"Jakarta Commons HTTPClient implements the\nclient side of HTTP standards.\n\nIt was discovered that the HTTPClient incorrectly extracted host name from\nan X.509 certificate subject's Common Name (CN) field. A man-in-the-middle\nattacker could use this flaw to spoof an SSL server using a specially\ncrafted X.509 certificate. (CVE-2014-3577)\n\nFor additional information on this flaw, refer to the Knowledgebase\narticle in the References section.\n\nAll jakarta-commons-httpclient users are advised to upgrade to these\nupdated packages, which contain a backported patch to correct this issue.\n\n4. Solution:\n\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at the linked references.\n\n5. Bugs fixed:\n\n1129074 - CVE-2014-3577 Apache HttpComponents client: SSL hostname verification\nbypass, incomplete CVE-2012-6153 fix\n\n6. Package List:\n\nRed Hat Enterprise Linux Desktop (v. 5 client):\n\nSource:\njakarta-commons-httpclient-3.0-7jpp.4.el5_10.src.rpm\n\ni386:\njakarta-commons-httpclient-3.0-7jpp.4.el5_10.i386.rpm\njakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10.i386.rpm\n\nx86_64:\njakarta-commons-httpclient-3.0-7jpp.4.el5_10.x86_64.rpm\njakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10.x86_64.rpm\n\nRed Hat Enterprise Linux Desktop Workstation (v. 5 client):\n\nSource:\njakarta-commons-httpclient-3.0-7jpp.4.el5_10.src.rpm\n\ni386:\njakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10.i386.rpm\njakarta-commons-httpclient-demo-3.0-7jpp.4.el5_10.i386.rpm\njakarta-commons-httpclient-javadoc-3.0-7jpp.4.el5_10.i386.rpm\njakarta-commons-httpclient-manual-3.0-7jpp.4.el5_10.i386.rpm\n\nx86_64:\njakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10.x86_64.rpm\njakarta-commons-httpclient-demo-3.0-7jpp.4.el5_10.x86_64.rpm\njakarta-commons-httpclient-javadoc-3.0-7jpp.4.el5_10.x86_64.rpm\njakarta-commons-httpclient-manual-3.0-7jpp.4.el5_10.x86_64.rpm\n\nRed Hat Enterprise Linux (v. 5 server):\n\nSource:\njakarta-commons-httpclient-3.0-7jpp.4.el5_10.src.rpm\n\ni386:\njakarta-commons-httpclient-3.0-7jpp.4.el5_10.i386.rpm\njakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10.i386.rpm\njakarta-commons-httpclient-demo-3.0-7jpp.4.el5_10.i386.rpm\njakarta-commons-httpclient-javadoc-3.0-7jpp.4.el5_10.i386.rpm\njakarta-commons-httpclient-manual-3.0-7jpp.4.el5_10.i386.rpm\n\nia64:\njak ...\n\n Description truncated, please see the referenced URL(s) for more information.\");\n script_tag(name:\"affected\", value:\"jakarta-commons-httpclient on CentOS 7\");\n script_tag(name:\"solution\", value:\"Please install the updated packages.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_xref(name:\"CESA\", value:\"2014:1166\");\n script_xref(name:\"URL\", value:\"http://lists.centos.org/pipermail/centos-announce/2014-September/020546.html\");\n script_xref(name:\"URL\", value:\"https://access.redhat.com/articles/11258\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'jakarta-commons-httpclient'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2014 Greenbone Networks GmbH\");\n script_family(\"CentOS Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/centos\", \"ssh/login/rpms\", re:\"ssh/login/release=CentOS7\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"CentOS7\")\n{\n\n if ((res = isrpmvuln(pkg:\"jakarta-commons-httpclient\", rpm:\"jakarta-commons-httpclient~3.1~16.el7_0\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"jakarta-commons-httpclient-demo\", rpm:\"jakarta-commons-httpclient-demo~3.1~16.el7_0\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"jakarta-commons-httpclient-javadoc\", rpm:\"jakarta-commons-httpclient-javadoc~3.1~16.el7_0\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"jakarta-commons-httpclient-manual\", rpm:\"jakarta-commons-httpclient-manual~3.1~16.el7_0\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2019-05-29T18:34:30", "bulletinFamily": "scanner", "description": "HP Helion Eucalyptus is prone to multiple vulnerabilities.", "modified": "2018-10-26T00:00:00", "published": "2017-01-12T00:00:00", "id": "OPENVAS:1361412562310106512", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310106512", "title": "HP Helion Eucalyptus Multiple Vulnerabilities", "type": "openvas", "sourceData": "##############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_hp_helion_eucalyptus_mult_vuln.nasl 12106 2018-10-26 06:33:36Z cfischer $\n#\n# HP Helion Eucalyptus Multiple Vulnerabilities\n#\n# Authors:\n# Christian Kuersteiner <christian.kuersteiner@greenbone.net>\n#\n# Copyright:\n# Copyright (c) 2017 Greenbone Networks GmbH\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = 'cpe:/a:eucalyptus:eucalyptus';\n\nif (description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.106512\");\n script_version(\"$Revision: 12106 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-10-26 08:33:36 +0200 (Fri, 26 Oct 2018) $\");\n script_tag(name:\"creation_date\", value:\"2017-01-12 13:24:55 +0700 (Thu, 12 Jan 2017)\");\n script_tag(name:\"cvss_base\", value:\"6.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:P/I:P/A:P\");\n\n script_cve_id(\"CVE-2014-3577\", \"CVE-2016-8520\");\n\n script_tag(name:\"qod_type\", value:\"remote_banner\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_name(\"HP Helion Eucalyptus Multiple Vulnerabilities\");\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"This script is Copyright (C) 2017 Greenbone Networks GmbH\");\n script_family(\"Web application abuses\");\n script_dependencies(\"gb_hp_helion_eucalyptus_detect.nasl\");\n script_mandatory_keys(\"hp/helion_eucalyptus/installed\");\n\n script_tag(name:\"summary\", value:\"HP Helion Eucalyptus is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"HP Helion Eucalyptus is prone to multiple vulnerabilities:\n\n - A version of Apache httpclient library shipped with Eucalyptus does not correctly validates server hostname\nwhen checking X.509 certificates. This vulnerability can allow a man-in-the-middle attack to spoof an SSL server\nand hijack a connection. (CVE-2014-3577)\n\n - HP Helion Eucalyptus does not correctly check IAM user's permissions for accessing versioned objects and ACLs.\nIn some cases, authenticated users with S3 permissions could also access versioned data. (CVE-2016-8520)\");\n\n script_tag(name:\"impact\", value:\"An attacker may hijack a connection or an authenticated user may access\nversioned data.\");\n\n script_tag(name:\"affected\", value:\"HP Helion Eucalyptus version 4.3.0 and prior.\");\n\n script_tag(name:\"solution\", value:\"Update to version 4.3.1\");\n\n script_xref(name:\"URL\", value:\"https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05363782\");\n\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif (!port = get_app_port(cpe: CPE))\n exit(0);\n\nif (!version = get_app_version(cpe: CPE, port: port))\n exit(0);\n\nif (version_is_less(version: version, test_version: \"4.3.1\")) {\n report = report_fixed_ver(installed_version: version, fixed_version: \"4.3.1\");\n security_message(port: port, data: report);\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:37:10", "bulletinFamily": "scanner", "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2014-09-09T00:00:00", "id": "OPENVAS:1361412562310882000", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310882000", "title": "CentOS Update for jakarta-commons-httpclient CESA-2014:1166 centos5", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# CentOS Update for jakarta-commons-httpclient CESA-2014:1166 centos5\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2014 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.882000\");\n script_version(\"$Revision: 14222 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 13:50:48 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2014-09-09 05:55:07 +0200 (Tue, 09 Sep 2014)\");\n script_cve_id(\"CVE-2014-3577\", \"CVE-2012-6153\");\n script_tag(name:\"cvss_base\", value:\"5.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_name(\"CentOS Update for jakarta-commons-httpclient CESA-2014:1166 centos5\");\n script_tag(name:\"insight\", value:\"Jakarta Commons HTTPClient implements the\nclient side of HTTP standards.\n\nIt was discovered that the HTTPClient incorrectly extracted host name from\nan X.509 certificate subject's Common Name (CN) field. A man-in-the-middle\nattacker could use this flaw to spoof an SSL server using a specially\ncrafted X.509 certificate. (CVE-2014-3577)\n\nFor additional information on this flaw, refer to the Knowledgebase\narticle in the References section.\n\nAll jakarta-commons-httpclient users are advised to upgrade to these\nupdated packages, which contain a backported patch to correct this issue.\n\n4. Solution:\n\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at the linked references.\n\n5. Bugs fixed:\n\n1129074 - CVE-2014-3577 Apache HttpComponents client: SSL hostname verification bypass, incomplete CVE-2012-6153 fix\n\n6. Package List:\n\nRed Hat Enterprise Linux Desktop (v. 5 client):\n\nSource:\njakarta-commons-httpclient-3.0-7jpp.4.el5_10.src.rpm\n\ni386:\njakarta-commons-httpclient-3.0-7jpp.4.el5_10.i386.rpm\njakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10.i386.rpm\n\nx86_64:\njakarta-commons-httpclient-3.0-7jpp.4.el5_10.x86_64.rpm\njakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10.x86_64.rpm\n\nRed Hat Enterprise Linux Desktop Workstation (v. 5 client):\n\nSource:\njakarta-commons-httpclient-3.0-7jpp.4.el5_10.src.rpm\n\ni386:\njakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10.i386.rpm\njakarta-commons-httpclient-demo-3.0-7jpp.4.el5_10.i386.rpm\njakarta-commons-httpclient-javadoc-3.0-7jpp.4.el5_10.i386.rpm\njakarta-commons-httpclient-manual-3.0-7jpp.4.el5_10.i386.rpm\n\nx86_64:\njakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10.x86_64.rpm\njakarta-commons-httpclient-demo-3.0-7jpp.4.el5_10.x86_64.rpm\njakarta-commons-httpclient-javadoc-3.0-7jpp.4.el5_10.x86_64.rpm\njakarta-commons-httpclient-manual-3.0-7jpp.4.el5_10.x86_64.rpm\n\nRed Hat Enterprise Linux (v. 5 server):\n\nSource:\njakarta-commons-httpclient-3.0-7jpp.4.el5_10.src.rpm\n\ni386:\njakarta-commons-httpclient-3.0-7jpp.4.el5_10.i386.rpm\njakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10.i386.rpm\njakarta-commons-httpclient-demo-3.0-7jpp.4.el5_10.i386.rpm\njakarta-commons-httpclient-javadoc-3.0-7jpp.4.el5_10.i386.rpm\njakarta-commons-httpclient-manual-3.0-7jpp.4.el5_10.i386.rpm\n\nia64:\njak ...\n\n Description truncated, please see the referenced URL(s) for more information.\");\n script_tag(name:\"affected\", value:\"jakarta-commons-httpclient on CentOS 5\");\n script_tag(name:\"solution\", value:\"Please install the updated packages.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_xref(name:\"CESA\", value:\"2014:1166\");\n script_xref(name:\"URL\", value:\"http://lists.centos.org/pipermail/centos-announce/2014-September/020544.html\");\n script_xref(name:\"URL\", value:\"https://access.redhat.com/articles/11258\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'jakarta-commons-httpclient'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2014 Greenbone Networks GmbH\");\n script_family(\"CentOS Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/centos\", \"ssh/login/rpms\", re:\"ssh/login/release=CentOS5\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"CentOS5\")\n{\n\n if ((res = isrpmvuln(pkg:\"jakarta-commons-httpclient\", rpm:\"jakarta-commons-httpclient~3.0~7jpp.4.el5_10\", rls:\"CentOS5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"jakarta-commons-httpclient-demo\", rpm:\"jakarta-commons-httpclient-demo~3.0~7jpp.4.el5_10\", rls:\"CentOS5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"jakarta-commons-httpclient-javadoc\", rpm:\"jakarta-commons-httpclient-javadoc~3.0~7jpp.4.el5_10\", rls:\"CentOS5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"jakarta-commons-httpclient-manual\", rpm:\"jakarta-commons-httpclient-manual~3.0~7jpp.4.el5_10\", rls:\"CentOS5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2019-05-29T18:37:18", "bulletinFamily": "scanner", "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2014-09-10T00:00:00", "id": "OPENVAS:1361412562310882002", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310882002", "title": "CentOS Update for httpcomponents-client CESA-2014:1146 centos7", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# CentOS Update for httpcomponents-client CESA-2014:1146 centos7\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2014 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.882002\");\n script_version(\"$Revision: 14222 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 13:50:48 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2014-09-10 06:19:32 +0200 (Wed, 10 Sep 2014)\");\n script_cve_id(\"CVE-2014-3577\", \"CVE-2012-6153\");\n script_tag(name:\"cvss_base\", value:\"5.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_name(\"CentOS Update for httpcomponents-client CESA-2014:1146 centos7\");\n script_tag(name:\"insight\", value:\"HttpClient is an HTTP/1.1 compliant HTTP\nagent implementation based on httpcomponents HttpCore.\n\nIt was discovered that the HttpClient incorrectly extracted host name from\nan X.509 certificate subject's Common Name (CN) field. A man-in-the-middle\nattacker could use this flaw to spoof an SSL server using a specially\ncrafted X.509 certificate. (CVE-2014-3577)\n\nFor additional information on this flaw, refer to the Knowledgebase\narticle in the References section.\n\nAll httpcomponents-client users are advised to upgrade to these updated\npackages, which contain a backported patch to correct this issue.\n\n4. Solution:\n\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at the linked references.\n\n5. Bugs fixed:\n\n1129074 - CVE-2014-3577 Apache HttpComponents client: SSL hostname verification\nbypass, incomplete CVE-2012-6153 fix\n\n6. Package List:\n\nRed Hat Enterprise Linux Client Optional (v. 7):\n\nSource:\nhttpcomponents-client-4.2.5-5.el7_0.src.rpm\n\nnoarch:\nhttpcomponents-client-4.2.5-5.el7_0.noarch.rpm\nhttpcomponents-client-javadoc-4.2.5-5.el7_0.noarch.rpm\n\nRed Hat Enterprise Linux ComputeNode Optional (v. 7):\n\nSource:\nhttpcomponents-client-4.2.5-5.el7_0.src.rpm\n\nnoarch:\nhttpcomponents-client-4.2.5-5.el7_0.noarch.rpm\nhttpcomponents-client-javadoc-4.2.5-5.el7_0.noarch.rpm\n\nRed Hat Enterprise Linux Server (v. 7):\n\nSource:\nhttpcomponents-client-4.2.5-5.el7_0.src.rpm\n\nnoarch:\nhttpcomponents-client-4.2.5-5.el7_0.noarch.rpm\n\nRed Hat Enterprise Linux Server Optional (v. 7):\n\nSource:\nhttpcomponents-client-4.2.5-5.el7_0.src.rpm\n\nnoarch:\nhttpcomponents-client-4.2.5-5.el7_0.noarch.rpm\nhttpcomponents-client-javadoc-4.2.5-5.el7_0.noarch.rpm\n\nRed Hat Enterprise Linux Workstation (v. 7):\n\nSource:\nhttpcomponents-client-4.2.5-5.el7_0.src.rpm\n\nnoarch:\nhttpcomponents-client-4.2.5-5.el7_0.noarch.rpm\n\nRed Hat Enterprise Linux Workstation Optional (v. 7):\n\nnoarch:\nhttpcomponents-client-javadoc-4.2.5-5.el7_0.noarch.rpm\n\nThese packages are GPG signed by Red Hat for security. Our key and\ndetails on how to verify the signature are available from the references.\n\n Description truncated, please see the referenced URL(s) for more information.\");\n script_tag(name:\"affected\", value:\"httpcomponents-client on CentOS 7\");\n script_tag(name:\"solution\", value:\"Please install the updated packages.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_xref(name:\"CESA\", value:\"2014:1146\");\n script_xref(name:\"URL\", value:\"http://lists.centos.org/pipermail/centos-announce/2014-September/020530.html\");\n script_xref(name:\"URL\", value:\"https://access.redhat.com/security/team/key/#package\");\n script_xref(name:\"URL\", value:\"https://access.redhat.com/articles/11258\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'httpcomponents-client'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2014 Greenbone Networks GmbH\");\n script_family(\"CentOS Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/centos\", \"ssh/login/rpms\", re:\"ssh/login/release=CentOS7\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"CentOS7\")\n{\n\n if ((res = isrpmvuln(pkg:\"httpcomponents-client\", rpm:\"httpcomponents-client~4.2.5~5.el7_0\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"httpcomponents-client-javadoc\", rpm:\"httpcomponents-client-javadoc~4.2.5~5.el7_0\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2019-05-29T18:37:35", "bulletinFamily": "scanner", "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2014-09-09T00:00:00", "id": "OPENVAS:1361412562310881999", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310881999", "title": "CentOS Update for jakarta-commons-httpclient CESA-2014:1166 centos6", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# CentOS Update for jakarta-commons-httpclient CESA-2014:1166 centos6\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2014 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.881999\");\n script_version(\"$Revision: 14222 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 13:50:48 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2014-09-09 05:54:55 +0200 (Tue, 09 Sep 2014)\");\n script_cve_id(\"CVE-2014-3577\", \"CVE-2012-6153\");\n script_tag(name:\"cvss_base\", value:\"5.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_name(\"CentOS Update for jakarta-commons-httpclient CESA-2014:1166 centos6\");\n script_tag(name:\"insight\", value:\"Jakarta Commons HTTPClient implements the\nclient side of HTTP standards.\n\nIt was discovered that the HTTPClient incorrectly extracted host name from\nan X.509 certificate subject's Common Name (CN) field. A man-in-the-middle\nattacker could use this flaw to spoof an SSL server using a specially\ncrafted X.509 certificate. (CVE-2014-3577)\n\nFor additional information on this flaw, refer to the Knowledgebase\narticle in the References section.\n\nAll jakarta-commons-httpclient users are advised to upgrade to these\nupdated packages, which contain a backported patch to correct this issue.\n\n4. Solution:\n\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at the linked references.\n\n5. Bugs fixed:\n\n1129074 - CVE-2014-3577 Apache HttpComponents client: SSL hostname verification\nbypass, incomplete CVE-2012-6153 fix\n\n6. Package List:\n\nRed Hat Enterprise Linux Desktop (v. 5 client):\n\nSource:\njakarta-commons-httpclient-3.0-7jpp.4.el5_10.src.rpm\n\ni386:\njakarta-commons-httpclient-3.0-7jpp.4.el5_10.i386.rpm\njakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10.i386.rpm\n\nx86_64:\njakarta-commons-httpclient-3.0-7jpp.4.el5_10.x86_64.rpm\njakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10.x86_64.rpm\n\nRed Hat Enterprise Linux Desktop Workstation (v. 5 client):\n\nSource:\njakarta-commons-httpclient-3.0-7jpp.4.el5_10.src.rpm\n\ni386:\njakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10.i386.rpm\njakarta-commons-httpclient-demo-3.0-7jpp.4.el5_10.i386.rpm\njakarta-commons-httpclient-javadoc-3.0-7jpp.4.el5_10.i386.rpm\njakarta-commons-httpclient-manual-3.0-7jpp.4.el5_10.i386.rpm\n\nx86_64:\njakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10.x86_64.rpm\njakarta-commons-httpclient-demo-3.0-7jpp.4.el5_10.x86_64.rpm\njakarta-commons-httpclient-javadoc-3.0-7jpp.4.el5_10.x86_64.rpm\njakarta-commons-httpclient-manual-3.0-7jpp.4.el5_10.x86_64.rpm\n\nRed Hat Enterprise Linux (v. 5 server):\n\nSource:\njakarta-commons-httpclient-3.0-7jpp.4.el5_10.src.rpm\n\ni386:\njakarta-commons-httpclient-3.0-7jpp.4.el5_10.i386.rpm\njakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10.i386.rpm\njakarta-commons-httpclient-demo-3.0-7jpp.4.el5_10.i386.rpm\njakarta-commons-httpclient-javadoc-3.0-7jpp.4.el5_10.i386.rpm\njakarta-commons-httpclient-manual-3.0-7jpp.4.el5_10.i386.rpm\n\nia64:\njak ...\n\n Description truncated, please see the referenced URL(s) for more information.\");\n script_tag(name:\"affected\", value:\"jakarta-commons-httpclient on CentOS 6\");\n script_tag(name:\"solution\", value:\"Please install the updated packages.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_xref(name:\"CESA\", value:\"2014:1166\");\n script_xref(name:\"URL\", value:\"http://lists.centos.org/pipermail/centos-announce/2014-September/020545.html\");\n script_xref(name:\"URL\", value:\"https://access.redhat.com/articles/11258\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'jakarta-commons-httpclient'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2014 Greenbone Networks GmbH\");\n script_family(\"CentOS Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/centos\", \"ssh/login/rpms\", re:\"ssh/login/release=CentOS6\");\n exit(0);\n}\n\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"CentOS6\")\n{\n\n if ((res = isrpmvuln(pkg:\"jakarta-commons-httpclient\", rpm:\"jakarta-commons-httpclient~3.1~0.9.el6_5\", rls:\"CentOS6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"jakarta-commons-httpclient-demo\", rpm:\"jakarta-commons-httpclient-demo~3.1~0.9.el6_5\", rls:\"CentOS6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"jakarta-commons-httpclient-javadoc\", rpm:\"jakarta-commons-httpclient-javadoc~3.1~0.9.el6_5\", rls:\"CentOS6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"jakarta-commons-httpclient-manual\", rpm:\"jakarta-commons-httpclient-manual~3.1~0.9.el6_5\", rls:\"CentOS6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}], "nessus": [{"lastseen": "2019-11-01T02:15:24", "bulletinFamily": "scanner", "description": "Updated httpcomponents-client packages that fix one security issue are\nnow available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having Important\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available from the\nCVE link in the References section.\n\nHttpClient is an HTTP/1.1 compliant HTTP agent implementation based on\nhttpcomponents HttpCore.\n\nIt was discovered that the HttpClient incorrectly extracted host name\nfrom an X.509 certificate subject", "modified": "2019-11-02T00:00:00", "id": "CENTOS_RHSA-2014-1146.NASL", "href": "https://www.tenable.com/plugins/nessus/77507", "published": "2014-09-04T00:00:00", "title": "CentOS 7 : httpcomponents-client (CESA-2014:1146)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2014:1146 and \n# CentOS Errata and Security Advisory 2014:1146 respectively.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(77507);\n script_version(\"1.7\");\n script_cvs_date(\"Date: 2019/10/02 15:30:19\");\n\n script_cve_id(\"CVE-2014-3577\");\n script_bugtraq_id(69258);\n script_xref(name:\"RHSA\", value:\"2014:1146\");\n\n script_name(english:\"CentOS 7 : httpcomponents-client (CESA-2014:1146)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote CentOS host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated httpcomponents-client packages that fix one security issue are\nnow available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having Important\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available from the\nCVE link in the References section.\n\nHttpClient is an HTTP/1.1 compliant HTTP agent implementation based on\nhttpcomponents HttpCore.\n\nIt was discovered that the HttpClient incorrectly extracted host name\nfrom an X.509 certificate subject's Common Name (CN) field. A\nman-in-the-middle attacker could use this flaw to spoof an SSL server\nusing a specially crafted X.509 certificate. (CVE-2014-3577)\n\nFor additional information on this flaw, refer to the Knowledgebase\narticle in the References section.\n\nAll httpcomponents-client users are advised to upgrade to these\nupdated packages, which contain a backported patch to correct this\nissue.\"\n );\n # https://lists.centos.org/pipermail/centos-announce/2014-September/020530.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?54c903f8\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected httpcomponents-client packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:httpcomponents-client\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:httpcomponents-client-javadoc\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:centos:centos:7\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2014/08/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/09/03\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/09/04\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"CentOS Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/CentOS/release\", \"Host/CentOS/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/CentOS/release\");\nif (isnull(release) || \"CentOS\" >!< release) audit(AUDIT_OS_NOT, \"CentOS\");\nos_ver = pregmatch(pattern: \"CentOS(?: Linux)? release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"CentOS\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"CentOS 7.x\", \"CentOS \" + os_ver);\n\nif (!get_kb_item(\"Host/CentOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"CentOS\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"httpcomponents-client-4.2.5-5.el7_0\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"httpcomponents-client-javadoc-4.2.5-5.el7_0\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"httpcomponents-client / httpcomponents-client-javadoc\");\n}\n", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2019-11-01T02:15:24", "bulletinFamily": "scanner", "description": "Updated jakarta-commons-httpclient packages that fix one security\nissue are now available for Red Hat Enterprise Linux 5, 6, and 7.\n\nRed Hat Product Security has rated this update as having Important\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available from the\nCVE link in the References section.\n\nJakarta Commons HTTPClient implements the client side of HTTP\nstandards.\n\nIt was discovered that the HTTPClient incorrectly extracted host name\nfrom an X.509 certificate subject", "modified": "2019-11-02T00:00:00", "id": "CENTOS_RHSA-2014-1166.NASL", "href": "https://www.tenable.com/plugins/nessus/77564", "published": "2014-09-09T00:00:00", "title": "CentOS 5 / 6 / 7 : jakarta-commons-httpclient (CESA-2014:1166)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2014:1166 and \n# CentOS Errata and Security Advisory 2014:1166 respectively.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(77564);\n script_version(\"1.8\");\n script_cvs_date(\"Date: 2019/10/02 15:30:19\");\n\n script_cve_id(\"CVE-2014-3577\");\n script_bugtraq_id(69258);\n script_xref(name:\"RHSA\", value:\"2014:1166\");\n\n script_name(english:\"CentOS 5 / 6 / 7 : jakarta-commons-httpclient (CESA-2014:1166)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote CentOS host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated jakarta-commons-httpclient packages that fix one security\nissue are now available for Red Hat Enterprise Linux 5, 6, and 7.\n\nRed Hat Product Security has rated this update as having Important\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available from the\nCVE link in the References section.\n\nJakarta Commons HTTPClient implements the client side of HTTP\nstandards.\n\nIt was discovered that the HTTPClient incorrectly extracted host name\nfrom an X.509 certificate subject's Common Name (CN) field. A\nman-in-the-middle attacker could use this flaw to spoof an SSL server\nusing a specially crafted X.509 certificate. (CVE-2014-3577)\n\nFor additional information on this flaw, refer to the Knowledgebase\narticle in the References section.\n\nAll jakarta-commons-httpclient users are advised to upgrade to these\nupdated packages, which contain a backported patch to correct this\nissue.\"\n );\n # https://lists.centos.org/pipermail/centos-announce/2014-September/020544.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?d73c8749\"\n );\n # https://lists.centos.org/pipermail/centos-announce/2014-September/020545.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?c085d854\"\n );\n # https://lists.centos.org/pipermail/centos-announce/2014-September/020546.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?42e0eb1d\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected jakarta-commons-httpclient packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:jakarta-commons-httpclient\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:jakarta-commons-httpclient-demo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:jakarta-commons-httpclient-javadoc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:jakarta-commons-httpclient-manual\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:centos:centos:5\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:centos:centos:6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:centos:centos:7\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2014/08/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/09/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/09/09\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"CentOS Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/CentOS/release\", \"Host/CentOS/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/CentOS/release\");\nif (isnull(release) || \"CentOS\" >!< release) audit(AUDIT_OS_NOT, \"CentOS\");\nos_ver = pregmatch(pattern: \"CentOS(?: Linux)? release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"CentOS\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(5|6|7)([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"CentOS 5.x / 6.x / 7.x\", \"CentOS \" + os_ver);\n\nif (!get_kb_item(\"Host/CentOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"CentOS\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"CentOS-5\", reference:\"jakarta-commons-httpclient-3.0-7jpp.4.el5_10\")) flag++;\nif (rpm_check(release:\"CentOS-5\", reference:\"jakarta-commons-httpclient-demo-3.0-7jpp.4.el5_10\")) flag++;\nif (rpm_check(release:\"CentOS-5\", reference:\"jakarta-commons-httpclient-javadoc-3.0-7jpp.4.el5_10\")) flag++;\nif (rpm_check(release:\"CentOS-5\", reference:\"jakarta-commons-httpclient-manual-3.0-7jpp.4.el5_10\")) flag++;\n\nif (rpm_check(release:\"CentOS-6\", reference:\"jakarta-commons-httpclient-3.1-0.9.el6_5\")) flag++;\nif (rpm_check(release:\"CentOS-6\", reference:\"jakarta-commons-httpclient-demo-3.1-0.9.el6_5\")) flag++;\nif (rpm_check(release:\"CentOS-6\", reference:\"jakarta-commons-httpclient-javadoc-3.1-0.9.el6_5\")) flag++;\nif (rpm_check(release:\"CentOS-6\", reference:\"jakarta-commons-httpclient-manual-3.1-0.9.el6_5\")) flag++;\n\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-3.1-16.el7_0\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-demo-3.1-16.el7_0\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-javadoc-3.1-16.el7_0\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-manual-3.1-16.el7_0\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"jakarta-commons-httpclient / jakarta-commons-httpclient-demo / etc\");\n}\n", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2019-11-01T03:14:30", "bulletinFamily": "scanner", "description": "From Red Hat Security Advisory 2014:1146 :\n\nUpdated httpcomponents-client packages that fix one security issue are\nnow available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having Important\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available from the\nCVE link in the References section.\n\nHttpClient is an HTTP/1.1 compliant HTTP agent implementation based on\nhttpcomponents HttpCore.\n\nIt was discovered that the HttpClient incorrectly extracted host name\nfrom an X.509 certificate subject", "modified": "2019-11-02T00:00:00", "id": "ORACLELINUX_ELSA-2014-1146.NASL", "href": "https://www.tenable.com/plugins/nessus/77515", "published": "2014-09-04T00:00:00", "title": "Oracle Linux 7 : httpcomponents-client (ELSA-2014-1146)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2014:1146 and \n# Oracle Linux Security Advisory ELSA-2014-1146 respectively.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(77515);\n script_version(\"1.8\");\n script_cvs_date(\"Date: 2019/09/30 10:58:19\");\n\n script_cve_id(\"CVE-2014-3577\");\n script_bugtraq_id(69258);\n script_xref(name:\"RHSA\", value:\"2014:1146\");\n\n script_name(english:\"Oracle Linux 7 : httpcomponents-client (ELSA-2014-1146)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Oracle Linux host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"From Red Hat Security Advisory 2014:1146 :\n\nUpdated httpcomponents-client packages that fix one security issue are\nnow available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having Important\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available from the\nCVE link in the References section.\n\nHttpClient is an HTTP/1.1 compliant HTTP agent implementation based on\nhttpcomponents HttpCore.\n\nIt was discovered that the HttpClient incorrectly extracted host name\nfrom an X.509 certificate subject's Common Name (CN) field. A\nman-in-the-middle attacker could use this flaw to spoof an SSL server\nusing a specially crafted X.509 certificate. (CVE-2014-3577)\n\nFor additional information on this flaw, refer to the Knowledgebase\narticle in the References section.\n\nAll httpcomponents-client users are advised to upgrade to these\nupdated packages, which contain a backported patch to correct this\nissue.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://oss.oracle.com/pipermail/el-errata/2014-September/004397.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected httpcomponents-client packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:httpcomponents-client\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:httpcomponents-client-javadoc\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:7\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2014/08/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/09/03\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/09/04\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Oracle Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/OracleLinux\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/OracleLinux\")) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || !pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux)\", string:release)) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nos_ver = pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Oracle Linux\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Oracle Linux 7\", \"Oracle Linux \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Oracle Linux\", cpu);\nif (\"x86_64\" >!< cpu) audit(AUDIT_ARCH_NOT, \"x86_64\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"httpcomponents-client-4.2.5-5.el7_0\")) flag++;\nif (rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"httpcomponents-client-javadoc-4.2.5-5.el7_0\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"httpcomponents-client / httpcomponents-client-javadoc\");\n}\n", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2019-11-01T03:20:53", "bulletinFamily": "scanner", "description": "Updated httpcomponents-client packages that fix one security issue are\nnow available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having Important\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available from the\nCVE link in the References section.\n\nHttpClient is an HTTP/1.1 compliant HTTP agent implementation based on\nhttpcomponents HttpCore.\n\nIt was discovered that the HttpClient incorrectly extracted host name\nfrom an X.509 certificate subject", "modified": "2019-11-02T00:00:00", "id": "REDHAT-RHSA-2014-1146.NASL", "href": "https://www.tenable.com/plugins/nessus/77521", "published": "2014-09-04T00:00:00", "title": "RHEL 7 : httpcomponents-client (RHSA-2014:1146)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2014:1146. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(77521);\n script_version(\"1.16\");\n script_cvs_date(\"Date: 2019/10/24 15:35:38\");\n\n script_cve_id(\"CVE-2014-3577\");\n script_bugtraq_id(69258);\n script_xref(name:\"RHSA\", value:\"2014:1146\");\n\n script_name(english:\"RHEL 7 : httpcomponents-client (RHSA-2014:1146)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated httpcomponents-client packages that fix one security issue are\nnow available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having Important\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available from the\nCVE link in the References section.\n\nHttpClient is an HTTP/1.1 compliant HTTP agent implementation based on\nhttpcomponents HttpCore.\n\nIt was discovered that the HttpClient incorrectly extracted host name\nfrom an X.509 certificate subject's Common Name (CN) field. A\nman-in-the-middle attacker could use this flaw to spoof an SSL server\nusing a specially crafted X.509 certificate. (CVE-2014-3577)\n\nFor additional information on this flaw, refer to the Knowledgebase\narticle in the References section.\n\nAll httpcomponents-client users are advised to upgrade to these\nupdated packages, which contain a backported patch to correct this\nissue.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2014:1146\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2014-3577\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Update the affected httpcomponents-client and / or\nhttpcomponents-client-javadoc packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:httpcomponents-client\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:httpcomponents-client-javadoc\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.3\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.5\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.7\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2014/08/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/09/03\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/09/04\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 7.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2014:1146\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n if (rpm_check(release:\"RHEL7\", reference:\"httpcomponents-client-4.2.5-5.el7_0\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", reference:\"httpcomponents-client-javadoc-4.2.5-5.el7_0\")) flag++;\n\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"httpcomponents-client / httpcomponents-client-javadoc\");\n }\n}\n", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2019-11-01T03:14:30", "bulletinFamily": "scanner", "description": "From Red Hat Security Advisory 2014:1166 :\n\nUpdated jakarta-commons-httpclient packages that fix one security\nissue are now available for Red Hat Enterprise Linux 5, 6, and 7.\n\nRed Hat Product Security has rated this update as having Important\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available from the\nCVE link in the References section.\n\nJakarta Commons HTTPClient implements the client side of HTTP\nstandards.\n\nIt was discovered that the HTTPClient incorrectly extracted host name\nfrom an X.509 certificate subject", "modified": "2019-11-02T00:00:00", "id": "ORACLELINUX_ELSA-2014-1166.NASL", "href": "https://www.tenable.com/plugins/nessus/77566", "published": "2014-09-09T00:00:00", "title": "Oracle Linux 5 / 6 / 7 : jakarta-commons-httpclient (ELSA-2014-1166)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2014:1166 and \n# Oracle Linux Security Advisory ELSA-2014-1166 respectively.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(77566);\n script_version(\"1.9\");\n script_cvs_date(\"Date: 2019/09/30 10:58:19\");\n\n script_cve_id(\"CVE-2014-3577\");\n script_bugtraq_id(69258);\n script_xref(name:\"RHSA\", value:\"2014:1166\");\n\n script_name(english:\"Oracle Linux 5 / 6 / 7 : jakarta-commons-httpclient (ELSA-2014-1166)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Oracle Linux host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"From Red Hat Security Advisory 2014:1166 :\n\nUpdated jakarta-commons-httpclient packages that fix one security\nissue are now available for Red Hat Enterprise Linux 5, 6, and 7.\n\nRed Hat Product Security has rated this update as having Important\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available from the\nCVE link in the References section.\n\nJakarta Commons HTTPClient implements the client side of HTTP\nstandards.\n\nIt was discovered that the HTTPClient incorrectly extracted host name\nfrom an X.509 certificate subject's Common Name (CN) field. A\nman-in-the-middle attacker could use this flaw to spoof an SSL server\nusing a specially crafted X.509 certificate. (CVE-2014-3577)\n\nFor additional information on this flaw, refer to the Knowledgebase\narticle in the References section.\n\nAll jakarta-commons-httpclient users are advised to upgrade to these\nupdated packages, which contain a backported patch to correct this\nissue.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://oss.oracle.com/pipermail/el-errata/2014-September/004412.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://oss.oracle.com/pipermail/el-errata/2014-September/004413.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://oss.oracle.com/pipermail/el-errata/2014-September/004414.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected jakarta-commons-httpclient packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:jakarta-commons-httpclient\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:jakarta-commons-httpclient-demo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:jakarta-commons-httpclient-javadoc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:jakarta-commons-httpclient-manual\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:5\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:7\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2014/08/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/09/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/09/09\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Oracle Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/OracleLinux\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/OracleLinux\")) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || !pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux)\", string:release)) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nos_ver = pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Oracle Linux\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(5|6|7)([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Oracle Linux 5 / 6 / 7\", \"Oracle Linux \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && \"ia64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Oracle Linux\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"EL5\", reference:\"jakarta-commons-httpclient-3.0-7jpp.4.el5_10\")) flag++;\nif (rpm_check(release:\"EL5\", reference:\"jakarta-commons-httpclient-demo-3.0-7jpp.4.el5_10\")) flag++;\nif (rpm_check(release:\"EL5\", reference:\"jakarta-commons-httpclient-javadoc-3.0-7jpp.4.el5_10\")) flag++;\nif (rpm_check(release:\"EL5\", reference:\"jakarta-commons-httpclient-manual-3.0-7jpp.4.el5_10\")) flag++;\n\nif (rpm_check(release:\"EL6\", reference:\"jakarta-commons-httpclient-3.1-0.9.el6_5\")) flag++;\nif (rpm_check(release:\"EL6\", reference:\"jakarta-commons-httpclient-demo-3.1-0.9.el6_5\")) flag++;\nif (rpm_check(release:\"EL6\", reference:\"jakarta-commons-httpclient-javadoc-3.1-0.9.el6_5\")) flag++;\nif (rpm_check(release:\"EL6\", reference:\"jakarta-commons-httpclient-manual-3.1-0.9.el6_5\")) flag++;\n\nif (rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-3.1-16.el7_0\")) flag++;\nif (rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-demo-3.1-16.el7_0\")) flag++;\nif (rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-javadoc-3.1-16.el7_0\")) flag++;\nif (rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"jakarta-commons-httpclient-manual-3.1-16.el7_0\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"jakarta-commons-httpclient / jakarta-commons-httpclient-demo / etc\");\n}\n", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2019-11-01T02:27:18", "bulletinFamily": "scanner", "description": "Security fix for CVE-2014-3577\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "modified": "2019-11-02T00:00:00", "id": "FEDORA_2014-9617.NASL", "href": "https://www.tenable.com/plugins/nessus/77444", "published": "2014-08-30T00:00:00", "title": "Fedora 20 : httpcomponents-client-4.2.5-4.fc20 (2014-9617)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2014-9617.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(77444);\n script_version(\"1.4\");\n script_cvs_date(\"Date: 2018/12/05 20:31:22\");\n\n script_cve_id(\"CVE-2012-6153\", \"CVE-2014-3577\");\n script_bugtraq_id(69257, 69258);\n script_xref(name:\"FEDORA\", value:\"2014-9617\");\n\n script_name(english:\"Fedora 20 : httpcomponents-client-4.2.5-4.fc20 (2014-9617)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Security fix for CVE-2014-3577\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1129074\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2014-August/137180.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?a00de90f\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected httpcomponents-client package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:httpcomponents-client\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:20\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/08/21\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/08/30\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^20([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 20.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC20\", reference:\"httpcomponents-client-4.2.5-4.fc20\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"httpcomponents-client\");\n}\n", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2019-11-01T03:20:54", "bulletinFamily": "scanner", "description": "Updated packages for Red Hat JBoss Enterprise Application Platform\n5.2.0 that fix two security issues are now available for Red Hat\nEnterprise Linux 4, 5, and 6.\n\nRed Hat Product Security has rated this update as having Important\nsecurity impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.\n\nRed Hat JBoss Enterprise Application Platform is a platform for Java\napplications, which integrates the JBoss Application Server with JBoss\nHibernate and JBoss Seam.\n\nIt was discovered that the HttpClient incorrectly extracted host name\nfrom an X.509 certificate subject", "modified": "2019-11-02T00:00:00", "id": "REDHAT-RHSA-2014-1834.NASL", "href": "https://www.tenable.com/plugins/nessus/79205", "published": "2014-11-12T00:00:00", "title": "RHEL 5 / 6 : JBoss EAP (RHSA-2014:1834)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2014:1834. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(79205);\n script_version(\"1.12\");\n script_cvs_date(\"Date: 2019/10/24 15:35:39\");\n\n script_cve_id(\"CVE-2012-6153\", \"CVE-2014-3577\");\n script_xref(name:\"RHSA\", value:\"2014:1834\");\n\n script_name(english:\"RHEL 5 / 6 : JBoss EAP (RHSA-2014:1834)\");\n script_summary(english:\"Checks the rpm output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated packages for Red Hat JBoss Enterprise Application Platform\n5.2.0 that fix two security issues are now available for Red Hat\nEnterprise Linux 4, 5, and 6.\n\nRed Hat Product Security has rated this update as having Important\nsecurity impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.\n\nRed Hat JBoss Enterprise Application Platform is a platform for Java\napplications, which integrates the JBoss Application Server with JBoss\nHibernate and JBoss Seam.\n\nIt was discovered that the HttpClient incorrectly extracted host name\nfrom an X.509 certificate subject's Common Name (CN) field. A\nman-in-the-middle attacker could use this flaw to spoof an SSL server\nusing a specially crafted X.509 certificate. (CVE-2012-6153,\nCVE-2014-3577)\n\nThe CVE-2012-6153 issue was discovered by Florian Weimer of Red Hat\nProduct Security.\n\nFor additional information on these flaws, refer to the Knowledgebase\narticle in the References section.\n\nAll users of Red Hat JBoss Enterprise Application Platform 5.2.0 on\nRed Hat Enterprise Linux 4, 5, and 6 are advised to upgrade to these\nupdated packages. The JBoss server process must be restarted for the\nupdate to take effect.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/solutions/1165533\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2014:1834\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2012-6153\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2014-3577\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected apache-cxf package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:apache-cxf\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:5\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:6\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2014/08/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/11/10\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/11/12\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(5|6)([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 5.x / 6.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2014:1834\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n\n if (! (rpm_exists(release:\"RHEL5\", rpm:\"jbossas-welcome-content-eap\") || rpm_exists(release:\"RHEL6\", rpm:\"jbossas-welcome-content-eap\"))) audit(AUDIT_PACKAGE_NOT_INSTALLED, \"JBoss EAP\");\n\n if (rpm_check(release:\"RHEL5\", reference:\"apache-cxf-2.2.12-14.patch_09.ep5.el5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", reference:\"apache-cxf-2.2.12-14.patch_09.el6\")) flag++;\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"apache-cxf\");\n }\n}\n", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2019-11-01T03:20:54", "bulletinFamily": "scanner", "description": "Updated packages for Red Hat JBoss Enterprise Web Platform 5.2.0 that\nfix two security issues are now available for Red Hat Enterprise Linux\n4, 5, and 6.\n\nRed Hat Product Security has rated this update as having Important\nsecurity impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.\n\nRed Hat JBoss Enterprise Web Platform is a platform for Java\napplications, which integrates the JBoss Web Server with JBoss\nHibernate and JBoss Seam.\n\nIt was discovered that the HttpClient incorrectly extracted host name\nfrom an X.509 certificate subject", "modified": "2019-11-02T00:00:00", "id": "REDHAT-RHSA-2014-1833.NASL", "href": "https://www.tenable.com/plugins/nessus/79204", "published": "2014-11-12T00:00:00", "title": "RHEL 5 / 6 : JBoss EWP (RHSA-2014:1833)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2014:1833. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(79204);\n script_version(\"1.12\");\n script_cvs_date(\"Date: 2019/10/24 15:35:39\");\n\n script_cve_id(\"CVE-2012-6153\", \"CVE-2014-3577\");\n script_xref(name:\"RHSA\", value:\"2014:1833\");\n\n script_name(english:\"RHEL 5 / 6 : JBoss EWP (RHSA-2014:1833)\");\n script_summary(english:\"Checks the rpm output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated packages for Red Hat JBoss Enterprise Web Platform 5.2.0 that\nfix two security issues are now available for Red Hat Enterprise Linux\n4, 5, and 6.\n\nRed Hat Product Security has rated this update as having Important\nsecurity impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.\n\nRed Hat JBoss Enterprise Web Platform is a platform for Java\napplications, which integrates the JBoss Web Server with JBoss\nHibernate and JBoss Seam.\n\nIt was discovered that the HttpClient incorrectly extracted host name\nfrom an X.509 certificate subject's Common Name (CN) field. A\nman-in-the-middle attacker could use this flaw to spoof an SSL server\nusing a specially crafted X.509 certificate. (CVE-2012-6153,\nCVE-2014-3577)\n\nThe CVE-2012-6153 issue was discovered by Florian Weimer of Red Hat\nProduct Security.\n\nFor additional information on these flaws, refer to the Knowledgebase\narticle in the References section.\n\nAll users of Red Hat JBoss Enterprise Web Platform 5.2.0 on Red Hat\nEnterprise Linux 4, 5, and 6 are advised to upgrade to these updated\npackages. The JBoss server process must be restarted for the update to\ntake effect.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/solutions/1165533\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2014:1833\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2012-6153\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2014-3577\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected apache-cxf package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:apache-cxf\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:5\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:6\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2014/08/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/11/10\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/11/12\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(5|6)([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 5.x / 6.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2014:1833\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n\n if (! (rpm_exists(release:\"RHEL5\", rpm:\"jbossas-seam2-\") || rpm_exists(release:\"RHEL6\", rpm:\"jbossas-seam2-\")) || rpm_exists(rpm:\"jbossas-welcome-content-eap\")) audit(AUDIT_PACKAGE_NOT_INSTALLED, \"JBoss EWP\");\n\n if (rpm_check(release:\"RHEL5\", reference:\"apache-cxf-2.2.12-14.patch_09.ep5.el5\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", reference:\"apache-cxf-2.2.12-14.patch_09.el6\")) flag++;\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"apache-cxf\");\n }\n}\n", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2019-11-01T02:39:20", "bulletinFamily": "scanner", "description": "Apache Axis2 reports :\n\nApache Axis2 1.7.4 is a maintenance release that includes fixes for\nseveral issues, including the following security issues : Session\nfixation (AXIS2-4739) and XSS (AXIS2-5683) vulnerabilities affecting\nthe admin console. A dependency on an Apache HttpClient version\naffected by known security vulnerabilities (CVE-2012-6153 and\nCVE-2014-3577); see AXIS2-5757.", "modified": "2019-11-02T00:00:00", "id": "FREEBSD_PKG_AC18046C9B0811E68011005056925DB4.NASL", "href": "https://www.tenable.com/plugins/nessus/94419", "published": "2016-10-31T00:00:00", "title": "FreeBSD : Axis2 -- Security vulnerabilities on dependency Apache HttpClient (ac18046c-9b08-11e6-8011-005056925db4)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2018 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(94419);\n script_version(\"2.2\");\n script_cvs_date(\"Date: 2018/11/10 11:49:45\");\n\n script_cve_id(\"CVE-2012-6153\", \"CVE-2014-3577\");\n\n script_name(english:\"FreeBSD : Axis2 -- Security vulnerabilities on dependency Apache HttpClient (ac18046c-9b08-11e6-8011-005056925db4)\");\n script_summary(english:\"Checks for updated package in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote FreeBSD host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Apache Axis2 reports :\n\nApache Axis2 1.7.4 is a maintenance release that includes fixes for\nseveral issues, including the following security issues : Session\nfixation (AXIS2-4739) and XSS (AXIS2-5683) vulnerabilities affecting\nthe admin console. A dependency on an Apache HttpClient version\naffected by known security vulnerabilities (CVE-2012-6153 and\nCVE-2014-3577); see AXIS2-5757.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://axis.apache.org/axis2/java/core/release-notes/1.7.4.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://issues.apache.org/jira/browse/AXIS2-4739\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://issues.apache.org/jira/browse/AXIS2-5683\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://issues.apache.org/jira/browse/AXIS2-5757\"\n );\n # https://vuxml.freebsd.org/freebsd/ac18046c-9b08-11e6-8011-005056925db4.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?c426e985\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:axis2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2012/12/06\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/10/28\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/10/31\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"axis2<1.7.4\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2019-11-01T02:27:18", "bulletinFamily": "scanner", "description": "Security fix for CVE-2014-3577\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "modified": "2019-11-02T00:00:00", "id": "FEDORA_2014-9629.NASL", "href": "https://www.tenable.com/plugins/nessus/77445", "published": "2014-08-30T00:00:00", "title": "Fedora 19 : httpcomponents-client-4.2.5-4.fc19 (2014-9629)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2014-9629.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(77445);\n script_version(\"1.4\");\n script_cvs_date(\"Date: 2018/12/05 20:31:22\");\n\n script_cve_id(\"CVE-2012-6153\", \"CVE-2014-3577\");\n script_bugtraq_id(69257, 69258);\n script_xref(name:\"FEDORA\", value:\"2014-9629\");\n\n script_name(english:\"Fedora 19 : httpcomponents-client-4.2.5-4.fc19 (2014-9629)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Security fix for CVE-2014-3577\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1129074\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2014-August/137174.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?8c63b231\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected httpcomponents-client package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:httpcomponents-client\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:19\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/08/21\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/08/30\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^19([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 19.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC19\", reference:\"httpcomponents-client-4.2.5-4.fc19\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"httpcomponents-client\");\n}\n", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}], "redhat": [{"lastseen": "2019-08-13T18:45:27", "bulletinFamily": "unix", "description": "HttpClient is an HTTP/1.1 compliant HTTP agent implementation based on\nhttpcomponents HttpCore.\n\nIt was discovered that the HttpClient incorrectly extracted host name from\nan X.509 certificate subject's Common Name (CN) field. A man-in-the-middle\nattacker could use this flaw to spoof an SSL server using a specially\ncrafted X.509 certificate. (CVE-2014-3577)\n\nFor additional information on this flaw, refer to the Knowledgebase\narticle in the References section.\n\nAll httpcomponents-client users are advised to upgrade to these updated\npackages, which contain a backported patch to correct this issue.\n", "modified": "2018-04-12T03:32:37", "published": "2014-09-03T04:00:00", "id": "RHSA-2014:1146", "href": "https://access.redhat.com/errata/RHSA-2014:1146", "type": "redhat", "title": "(RHSA-2014:1146) Important: httpcomponents-client security update", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2019-08-13T18:46:42", "bulletinFamily": "unix", "description": "Jakarta Commons HTTPClient implements the client side of HTTP standards.\n\nIt was discovered that the HTTPClient incorrectly extracted host name from\nan X.509 certificate subject's Common Name (CN) field. A man-in-the-middle\nattacker could use this flaw to spoof an SSL server using a specially\ncrafted X.509 certificate. (CVE-2014-3577)\n\nFor additional information on this flaw, refer to the Knowledgebase\narticle in the References section.\n\nAll jakarta-commons-httpclient users are advised to upgrade to these\nupdated packages, which contain a backported patch to correct this issue.\n", "modified": "2018-06-06T20:24:30", "published": "2014-09-08T04:00:00", "id": "RHSA-2014:1166", "href": "https://access.redhat.com/errata/RHSA-2014:1166", "type": "redhat", "title": "(RHSA-2014:1166) Important: jakarta-commons-httpclient security update", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2019-08-13T18:46:37", "bulletinFamily": "unix", "description": "Red Hat JBoss Enterprise Application Platform is a platform for Java\napplications, which integrates the JBoss Application Server with JBoss\nHibernate and JBoss Seam.\n\nIt was discovered that the HttpClient incorrectly extracted host name from\nan X.509 certificate subject's Common Name (CN) field. A man-in-the-middle\nattacker could use this flaw to spoof an SSL server using a specially\ncrafted X.509 certificate. (CVE-2012-6153, CVE-2014-3577)\n\nThe CVE-2012-6153 issue was discovered by Florian Weimer of Red Hat\nProduct Security.\n\nFor additional information on these flaws, refer to the Knowledgebase\narticle in the References section.\n\nAll users of Red Hat JBoss Enterprise Application Platform 5.2.0 on Red Hat\nEnterprise Linux 4, 5, and 6 are advised to upgrade to these updated\npackages. The JBoss server process must be restarted for the update to take\neffect.\n", "modified": "2018-06-07T02:37:43", "published": "2014-11-10T05:00:00", "id": "RHSA-2014:1834", "href": "https://access.redhat.com/errata/RHSA-2014:1834", "type": "redhat", "title": "(RHSA-2014:1834) Important: Red Hat JBoss Enterprise Application Platform 5.2.0 security update", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2019-08-13T18:44:49", "bulletinFamily": "unix", "description": "Red Hat JBoss Enterprise Web Platform is a platform for Java applications,\nwhich integrates the JBoss Web Server with JBoss Hibernate and JBoss Seam.\n\nIt was discovered that the HttpClient incorrectly extracted host name from\nan X.509 certificate subject's Common Name (CN) field. A man-in-the-middle\nattacker could use this flaw to spoof an SSL server using a specially\ncrafted X.509 certificate. (CVE-2012-6153, CVE-2014-3577)\n\nThe CVE-2012-6153 issue was discovered by Florian Weimer of Red Hat\nProduct Security.\n\nFor additional information on these flaws, refer to the Knowledgebase\narticle in the References section.\n\nAll users of Red Hat JBoss Enterprise Web Platform 5.2.0 on Red Hat\nEnterprise Linux 4, 5, and 6 are advised to upgrade to these updated\npackages. The JBoss server process must be restarted for the update to\ntake effect.\n", "modified": "2018-06-07T02:39:14", "published": "2014-11-10T05:00:00", "id": "RHSA-2014:1833", "href": "https://access.redhat.com/errata/RHSA-2014:1833", "type": "redhat", "title": "(RHSA-2014:1833) Important: Red Hat JBoss Enterprise Web Platform 5.2.0 security update", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2019-08-13T18:45:53", "bulletinFamily": "unix", "description": "Thermostat is a monitoring and instrumentation tool for the OpenJDK HotSpot\nJava Virtual Machine (JVM) with support for monitoring multiple\nJVM instances.\n\nThe httpcomponents-client package provides an HTTP agent implementation\nthat is used by Thermostat to visualize collected data in an HTTP-aware\nclient application.\n\nIt was found that the fix for CVE-2012-6153 was incomplete: the code added\nto check that the server hostname matches the domain name in a subject's\nCommon Name (CN) field in X.509 certificates was flawed.\nA man-in-the-middle attacker could use this flaw to spoof an SSL server\nusing a specially crafted X.509 certificate. (CVE-2014-3577)\n\nFor additional information on this flaw, refer to the Knowledgebase\narticle in the References section.\n\nAll thermostat1-httpcomponents-client users are advised to upgrade to these\nupdated packages, which contain a backported patch to correct this issue.\n", "modified": "2018-06-13T01:28:26", "published": "2014-08-20T04:00:00", "id": "RHSA-2014:1082", "href": "https://access.redhat.com/errata/RHSA-2014:1082", "type": "redhat", "title": "(RHSA-2014:1082) Important: thermostat1-httpcomponents-client security update", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2019-05-29T14:34:02", "bulletinFamily": "unix", "description": "Red Hat JBoss BPM Suite is a business rules and processes management system\nfor the management, storage, creation, modification, and deployment of\nJBoss rules and BPMN2-compliant business processes.\n\nThis roll up patch serves as a cumulative upgrade for Red Hat JBoss BPM\nSuite 6.0.3, and includes bug fixes and enhancements. It includes various\nbug fixes, which are listed in the README file included with the\npatch files.\n\nThe following security issues are fixed with this release:\n\nIt was discovered that Jakarta Commons HttpClient incorrectly extracted the\nhost name from an X.509 certificate subject's Common Name (CN) field.\nA man-in-the-middle attacker could use this flaw to spoof an SSL server\nusing a specially crafted X.509 certificate. (CVE-2012-6153, CVE-2014-3577)\n\nThe CVE-2012-6153 issue was discovered by Florian Weimer of Red Hat\nProduct Security.\n\nAll users of Red Hat JBoss BPM Suite 6.0.3 as provided from the Red Hat\nCustomer Portal are advised to apply this roll up patch.", "modified": "2019-02-20T17:18:42", "published": "2014-11-25T01:44:18", "id": "RHSA-2014:1892", "href": "https://access.redhat.com/errata/RHSA-2014:1892", "type": "redhat", "title": "(RHSA-2014:1892) Important: Red Hat JBoss BPM Suite 6.0.3 update", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2019-05-29T14:34:00", "bulletinFamily": "unix", "description": "Red Hat JBoss Fuse, based on Apache ServiceMix, provides a small-footprint, flexible, open source enterprise service bus and integration platform. Red Hat JBoss A-MQ, based on Apache ActiveMQ, is a standards compliant messaging system that is tailored for use in mission critical applications.\n\nThis patch is an update to Red Hat JBoss Fuse 6.2.1 and Red Hat JBoss A-MQ 6.2.1. It includes several bug fixes, which are documented in the readme.txt file included with the patch files.\n\nSecurity Fix(es):\n\n* It was found that the fix for CVE-2012-6153 was incomplete: the code\nadded to check that the server hostname matches the domain name in a\nsubject's Common Name (CN) field in X.509 certificates was flawed. A\nman-in-the-middle attacker could use this flaw to spoof an SSL server using\na specially crafted X.509 certificate. (CVE-2014-3577)\n\nRefer to the readme.txt file included with the patch files for installation instructions.", "modified": "2019-02-20T17:28:34", "published": "2016-09-24T00:29:27", "id": "RHSA-2016:1931", "href": "https://access.redhat.com/errata/RHSA-2016:1931", "type": "redhat", "title": "(RHSA-2016:1931) Important: Red Hat JBoss Fuse/A-MQ 6.2.1 security and bug fix update", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2019-05-29T14:33:33", "bulletinFamily": "unix", "description": "Red Hat JBoss BRMS is a business rules management system for the\nmanagement, storage, creation, modification, and deployment of JBoss Rules.\n\nThis roll up patch serves as a cumulative upgrade for Red Hat JBoss BRMS\n6.0.3, and includes bug fixes and enhancements. It includes various bug\nfixes, which are listed in the README file included with the patch files.\n\nThe following security issues are fixed with this release:\n\nIt was discovered that Jakarta Commons HttpClient incorrectly extracted the\nhost name from an X.509 certificate subject's Common Name (CN) field.\nA man-in-the-middle attacker could use this flaw to spoof an SSL server\nusing a specially crafted X.509 certificate. (CVE-2012-6153, CVE-2014-3577)\n\nThe CVE-2012-6153 issue was discovered by Florian Weimer of Red Hat\nProduct Security.\n\nAll users of Red Hat JBoss BRMS 6.0.3 as provided from the Red Hat Customer\nPortal are advised to apply this roll up patch.", "modified": "2019-02-20T17:18:20", "published": "2014-11-25T01:43:48", "id": "RHSA-2014:1891", "href": "https://access.redhat.com/errata/RHSA-2014:1891", "type": "redhat", "title": "(RHSA-2014:1891) Important: Red Hat JBoss BRMS 6.0.3 security update", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2019-08-13T18:46:36", "bulletinFamily": "unix", "description": "Red Hat JBoss Enterprise Web Platform is a platform for Java applications,\nwhich integrates the JBoss Web Server with JBoss Hibernate and JBoss Seam.\n\nIt was found that the fix for CVE-2012-5783 was incomplete: the code added\nto check that the server host name matches the domain name in a subject's\nCommon Name (CN) field in X.509 certificates was flawed.\nA man-in-the-middle attacker could use this flaw to spoof an SSL server\nusing a specially crafted X.509 certificate. (CVE-2012-6153)\n\nIt was discovered that the HttpClient incorrectly extracted host name from\nan X.509 certificate subject's Common Name (CN) field. A man-in-the-middle\nattacker could use this flaw to spoof an SSL server using a specially\ncrafted X.509 certificate. (CVE-2014-3577)\n\nThe CVE-2012-6153 issue was discovered by Florian Weimer of Red Hat\nProduct Security.\n\nFor additional information on these flaws, refer to the Knowledgebase\narticle in the References section.\n\nAll users of Red Hat JBoss Enterprise Web Platform 5.2.0 on Red Hat\nEnterprise Linux 4, 5, and 6 are advised to upgrade to these updated\npackages. The JBoss server process must be restarted for the update to take\neffect.\n", "modified": "2018-06-07T02:39:14", "published": "2014-09-29T04:00:00", "id": "RHSA-2014:1320", "href": "https://access.redhat.com/errata/RHSA-2014:1320", "type": "redhat", "title": "(RHSA-2014:1320) Important: Red Hat JBoss Enterprise Web Platform 5.2.0 security update", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2019-08-13T18:45:13", "bulletinFamily": "unix", "description": "Red Hat JBoss Enterprise Application Platform 6 is a platform for Java\napplications based on JBoss Application Server 7.\n\nIt was discovered that the Apache CXF incorrectly extracted the host name\nfrom an X.509 certificate subject's Common Name (CN) field.\nA man-in-the-middle attacker could use this flaw to spoof an SSL server\nusing a specially crafted X.509 certificate. (CVE-2012-6153, CVE-2014-3577)\n\nIt was found that Apache WSS4J (Web Services Security for Java), as used by\nApache CXF with the TransportBinding, did not, by default, properly enforce\nall security requirements associated with SAML SubjectConfirmation methods.\nA remote attacker could use this flaw to perform various types of spoofing\nattacks on web service endpoints secured by WSS4j that rely on SAML for\nauthentication. (CVE-2014-3623)\n\nThe CVE-2012-6153 issue was discovered by Florian Weimer of Red Hat\nProduct Security.\n\nAll users of Red Hat JBoss Enterprise Application Platform 6.3.2 on Red\nHat Enterprise Linux 5, 6, and 7 are advised to upgrade to these updated\npackages. The JBoss server process must be restarted for the update to\ntake effect.\n", "modified": "2018-06-07T02:41:56", "published": "2014-12-18T05:00:00", "id": "RHSA-2014:2019", "href": "https://access.redhat.com/errata/RHSA-2014:2019", "type": "redhat", "title": "(RHSA-2014:2019) Important: Red Hat JBoss Enterprise Application Platform 6.3.2 security update", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}], "github": [{"lastseen": "2019-11-21T12:51:05", "bulletinFamily": "software", "description": "org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a \"CN=\" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the \"foo,CN=www.apache.org\" string in the O field.", "modified": "2019-07-03T21:02:04", "published": "2018-10-17T00:05:06", "id": "GHSA-CFH5-3GHH-WFJX", "href": "https://github.com/advisories/GHSA-cfh5-3ghh-wfjx", "title": "Moderate severity vulnerability that affects org.apache.httpcomponents:httpclient", "type": "github", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}], "oraclelinux": [{"lastseen": "2019-05-29T18:38:50", "bulletinFamily": "unix", "description": "[1:3.1-16]\n- Fix MITM security vulnerability\n- Resolves: CVE-2014-3577", "modified": "2014-09-08T00:00:00", "published": "2014-09-08T00:00:00", "id": "ELSA-2014-1166", "href": "http://linux.oracle.com/errata/ELSA-2014-1166.html", "title": "jakarta-commons-httpclient security update", "type": "oraclelinux", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2019-05-29T18:34:56", "bulletinFamily": "unix", "description": "[4.2.5-5]\n- Fix MITM security vulnerability\n- Resolves: CVE-2014-3577", "modified": "2014-09-03T00:00:00", "published": "2014-09-03T00:00:00", "id": "ELSA-2014-1146", "href": "http://linux.oracle.com/errata/ELSA-2014-1146.html", "title": "httpcomponents-client security update", "type": "oraclelinux", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}], "centos": [{"lastseen": "2019-05-29T18:34:01", "bulletinFamily": "unix", "description": "**CentOS Errata and Security Advisory** CESA-2014:1166\n\n\nJakarta Commons HTTPClient implements the client side of HTTP standards.\n\nIt was discovered that the HTTPClient incorrectly extracted host name from\nan X.509 certificate subject's Common Name (CN) field. A man-in-the-middle\nattacker could use this flaw to spoof an SSL server using a specially\ncrafted X.509 certificate. (CVE-2014-3577)\n\nFor additional information on this flaw, refer to the Knowledgebase\narticle in the References section.\n\nAll jakarta-commons-httpclient users are advised to upgrade to these\nupdated packages, which contain a backported patch to correct this issue.\n\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2014-September/020544.html\nhttp://lists.centos.org/pipermail/centos-announce/2014-September/020545.html\nhttp://lists.centos.org/pipermail/centos-announce/2014-September/020546.html\n\n**Affected packages:**\njakarta-commons-httpclient\njakarta-commons-httpclient-demo\njakarta-commons-httpclient-javadoc\njakarta-commons-httpclient-manual\n\n**Upstream details at:**\nhttps://rhn.redhat.com/errata/RHSA-2014-1166.html", "modified": "2014-09-08T17:24:40", "published": "2014-09-08T16:54:16", "href": "http://lists.centos.org/pipermail/centos-announce/2014-September/020544.html", "id": "CESA-2014:1166", "title": "jakarta security update", "type": "centos", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2019-05-29T18:35:16", "bulletinFamily": "unix", "description": "**CentOS Errata and Security Advisory** CESA-2014:1146\n\n\nHttpClient is an HTTP/1.1 compliant HTTP agent implementation based on\nhttpcomponents HttpCore.\n\nIt was discovered that the HttpClient incorrectly extracted host name from\nan X.509 certificate subject's Common Name (CN) field. A man-in-the-middle\nattacker could use this flaw to spoof an SSL server using a specially\ncrafted X.509 certificate. (CVE-2014-3577)\n\nFor additional information on this flaw, refer to the Knowledgebase\narticle in the References section.\n\nAll httpcomponents-client users are advised to upgrade to these updated\npackages, which contain a backported patch to correct this issue.\n\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2014-September/020530.html\n\n**Affected packages:**\nhttpcomponents-client\nhttpcomponents-client-javadoc\n\n**Upstream details at:**\nhttps://rhn.redhat.com/errata/RHSA-2014-1146.html", "modified": "2014-09-03T23:09:02", "published": "2014-09-03T23:09:02", "href": "http://lists.centos.org/pipermail/centos-announce/2014-September/020530.html", "id": "CESA-2014:1146", "title": "httpcomponents security update", "type": "centos", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}], "freebsd": [{"lastseen": "2019-05-29T18:32:29", "bulletinFamily": "unix", "description": "\nApache Axis2 reports:\n\nApache Axis2 1.7.4 is a maintenance release that includes fixes for\n\t\tseveral issues, including the following security issues:\n\t\tSession fixation (AXIS2-4739) and XSS (AXIS2-5683) vulnerabilities\n\t\taffecting the admin console.\n\t\tA dependency on an Apache HttpClient version affected by known security\n\t\tvulnerabilities (CVE-2012-6153 and CVE-2014-3577); see AXIS2-5757.\n\n", "modified": "2012-12-06T00:00:00", "published": "2012-12-06T00:00:00", "id": "AC18046C-9B08-11E6-8011-005056925DB4", "href": "https://vuxml.freebsd.org/freebsd/ac18046c-9b08-11e6-8011-005056925db4.html", "title": "Axis2 -- Security vulnerabilities on dependency Apache HttpClient", "type": "freebsd", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}], "debian": [{"lastseen": "2019-05-30T02:21:39", "bulletinFamily": "unix", "description": "Package : commons-httpclient\nVersion : 3.1-9+deb6u1\nCVE ID : CVE-2012-5783 CVE-2012-6153 CVE-2014-3577\n\nCVE-2012-5783 and CVE-2012-6153\n Apache Commons HttpClient 3.1 did not verify that the server hostname\n matches a domain name in the subject&#x27;s Common Name (CN) or subjectAltName\n field of the X.509 certificate, which allows man-in-the-middle attackers to\n spoof SSL servers via an arbitrary valid certificate.\n Thanks to Alberto Fernandez Martinez for the patch.\n\nCVE-2014-3577\n It was found that the fix for CVE-2012-6153 was incomplete: the code added\n to check that the server hostname matches the domain name in a subject&#x27;s\n Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle\n attacker could use this flaw to spoof an SSL server using a specially\n crafted X.509 certificate. The fix for CVE-2012-6153 was intended to address\n the incomplete patch for CVE-2012-5783. The issue is now completely resolved\n by applying this patch and the one for the previous CVEs\n\n\nThis upload was prepared by Markus Koschany.\n\n", "modified": "2015-05-19T15:30:28", "published": "2015-05-19T15:30:28", "id": "DEBIAN:DLA-222-1:38FAF", "href": "https://lists.debian.org/debian-lts-announce/2015/debian-lts-announce-201505/msg00008.html", "title": "[SECURITY] [DLA 222-1] commons-httpclient security update", "type": "debian", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}], "amazon": [{"lastseen": "2019-05-29T17:22:51", "bulletinFamily": "unix", "description": "**Issue Overview:**\n\nApache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. \n\nIt was found that the fix for [CVE-2012-6153 __](<https://access.redhat.com/security/cve/CVE-2012-6153>) was incomplete: the code added to check that the server hostname matches the domain name in a subject's Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate. \n\nIt was found that the fix for [CVE-2012-5783 __](<https://access.redhat.com/security/cve/CVE-2012-5783>) was incomplete: the code added to check that the server host name matches the domain name in a subject's Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.\n\n \n**Affected Packages:** \n\n\njakarta-commons-httpclient\n\n \n**Issue Correction:** \nRun _yum update jakarta-commons-httpclient_ to update your system.\n\n \n\n\n**New Packages:**\n \n \n noarch: \n jakarta-commons-httpclient-manual-3.1-15.8.amzn1.noarch \n jakarta-commons-httpclient-demo-3.1-15.8.amzn1.noarch \n jakarta-commons-httpclient-javadoc-3.1-15.8.amzn1.noarch \n jakarta-commons-httpclient-3.1-15.8.amzn1.noarch \n \n src: \n jakarta-commons-httpclient-3.1-15.8.amzn1.src \n \n \n", "modified": "2014-09-19T12:09:00", "published": "2014-09-19T12:09:00", "id": "ALAS-2014-410", "href": "https://alas.aws.amazon.com/ALAS-2014-410.html", "title": "Important: jakarta-commons-httpclient", "type": "amazon", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}], "ubuntu": [{"lastseen": "2019-05-29T17:22:17", "bulletinFamily": "unix", "description": "It was discovered that Apache Commons HttpClient did not properly verify the Common Name or subjectAltName fields of X.509 certificates. An attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications. This issue only affected Ubuntu 12.04 LTS. (CVE-2012-5783)\n\nFlorian Weimer discovered the fix for CVE-2012-5783 was incomplete for Apache Commons HttpClient. An attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications. This issue only affected Ubuntu 12.04 LTS. (CVE-2012-6153)\n\nSubodh Iyengar and Will Shackleton discovered the fix for CVE-2012-5783 was incomplete for Apache Commons HttpClient. An attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications. (CVE-2014-3577)\n\nIt was discovered that Apache Commons HttpClient did not properly handle read timeouts during HTTPS handshakes. A remote attacker could trigger this flaw to cause a denial of service. (CVE-2015-5262)", "modified": "2015-10-14T00:00:00", "published": "2015-10-14T00:00:00", "id": "USN-2769-1", "href": "https://usn.ubuntu.com/2769-1/", "title": "Apache Commons HttpClient vulnerabilities", "type": "ubuntu", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}], "oracle": [{"lastseen": "2019-05-29T18:20:50", "bulletinFamily": "software", "description": "A Critical Patch Update is a collection of patches for multiple security vulnerabilities. Critical Patch Update patches are usually cumulative, but each advisory describes only the security fixes added since the previous Critical Patch Update advisory. Thus, prior Critical Patch Update advisories should be reviewed for information regarding earlier published security fixes. Please refer to: \n\n * [Critical Patch Updates, Security Alerts and Bulletins](<http://www.oracle.com/securityalerts>) for information about Oracle Security Advisories. \n\n**Oracle continues to periodically receive reports of attempts to maliciously exploit vulnerabilities for which Oracle has already released fixes. In some instances, it has been reported that attackers have been successful because targeted customers had failed to apply available Oracle patches. Oracle therefore strongly recommends that customers remain on actively-supported versions and apply Critical Patch Update fixes without delay.**\n\nThis Critical Patch Update contains 334 new security fixes across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at [ July 2018 Critical Patch Update: Executive Summary and Analysis](<https://support.oracle.com/rs?type=doc&id=2420273.1>).\n\nMany industry experts anticipate that exploits leveraging known flaws in modern processor designs will continue to be disclosed for the foreseeable future (i.e., \"Spectre\" variants). For information related to these issues, please refer to:\n\n * the January 2018 Critical Patch Update (and later) Advisories,\n * the \"Addendum to the January 2018 Critical Patch Update Advisory for Spectre (CVE-2017-5715, CVE-2017-5753) and Meltdown (CVE-2017-5754)\" ([Doc ID 2347948.1](<https://support.oracle.com/rs?type=doc&id=2347948.1>)), and\n * \"Information about processor vulnerabilities CVE-2018-3640 (\"Spectre v3a\") and CVE-2018-3639 (\"Spectre v4\")\" ([Doc ID 2399123.1](<https://support.oracle.com/rs?type=doc&id=2399123.1>)).\n\n \n", "modified": "2018-10-12T00:00:00", "published": "2018-07-17T00:00:00", "id": "ORACLE:CPUJUL2018-4258247", "href": "", "title": "CPU July 2018", "type": "oracle", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}]}