Lucene search

K

CentOS Update for jakarta-commons-httpclient CESA-2013:0270 centos5

🗓️ 22 Feb 2013 00:00:00Reported by Copyright (c) 2013 Greenbone Networks GmbHType 
openvas
 openvas
🔗 plugins.openvas.org👁 16 Views

CentOS Update for jakarta-commons-httpclient CESA-2013:0270 centos5. The Jakarta Commons HttpClient component can be used to build HTTP-aware client applications. The component did not verify server hostname matching domain name in the certificates, leading to spoofing of SSL servers

Show more
Related
Refs
Code
ReporterTitlePublishedViews
Family
IBM Security Bulletins
Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Tivoli Business Service Manager (CVE-2012-5783)
5 Sep 201816:28
ibm
IBM Security Bulletins
Security Bulletin: Information disclosure in Apache Commons HttpClient may affect WebSphere Application Server as part of IBM InfoSphere Global Name Management (CVE-2012-5783)
20 Apr 202217:04
ibm
IBM Security Bulletins
Security Bulletin: Information disclosure in Apache Commons HttpClient used by WebSphere Application Server shipped with Tivoli Integrated Portal (CVE-2012-5783)
23 Nov 201809:35
ibm
IBM Security Bulletins
Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with OpenPages GRC Platform (CVE-2012-5783)
21 Aug 201822:07
ibm
IBM Security Bulletins
Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Case Manager (CVE-2012-5783)
20 Jul 201800:48
ibm
IBM Security Bulletins
Security Bulletin: IBM FileNet Content Manager affected by Apache HttpClient security vulnerability
16 Jan 201920:05
ibm
IBM Security Bulletins
Security Bulletin: Information disclosure in Apache Commons HttpClient used by WebSphere Application Server bundled with IBM WebSphere Application Server Patterns (CVE-2012-5783)
26 Jun 201819:40
ibm
IBM Security Bulletins
Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Tivoli Netcool Impact (CVE-2012-5783)
5 Sep 201816:25
ibm
IBM Security Bulletins
Security Bulletin: Information disclosure in Apache Commons HttpClient used by WebSphere Application Server shipped with Jazz for Service Management (CVE-2012-5783)
28 Nov 201812:00
ibm
IBM Security Bulletins
Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Digital Business Automation Workflow family products (CVE-2012-5783)
14 Sep 202215:57
ibm
Rows per page
###############################################################################
# OpenVAS Vulnerability Test
#
# CentOS Update for jakarta-commons-httpclient CESA-2013:0270 centos5 
#
# Authors:
# System Generated Check
#
# Copyright:
# Copyright (c) 2013 Greenbone Networks GmbH, http://www.greenbone.net
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License version 2
# (or any later version), as published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
###############################################################################

include("revisions-lib.inc");
tag_insight = "The Jakarta Commons HttpClient component can be used to build HTTP-aware
  client applications (such as web browsers and web service clients).

  The Jakarta Commons HttpClient component did not verify that the server
  hostname matched the domain name in the subject's Common Name (CN) or
  subjectAltName field in X.509 certificates. This could allow a
  man-in-the-middle attacker to spoof an SSL server if they had a certificate
  that was valid for any domain name. (CVE-2012-5783)
  
  All users of jakarta-commons-httpclient are advised to upgrade to these
  updated packages, which correct this issue. Applications using the Jakarta
  Commons HttpClient component must be restarted for this update to take
  effect.";


tag_affected = "jakarta-commons-httpclient on CentOS 5";
tag_solution = "Please Install the Updated Packages.";



if(description)
{
  script_xref(name : "URL" , value : "http://lists.centos.org/pipermail/centos-announce/2013-February/019241.html");
  script_id(881604);
  script_version("$Revision: 8494 $");
  script_tag(name:"last_modification", value:"$Date: 2018-01-23 07:57:55 +0100 (Tue, 23 Jan 2018) $");
  script_tag(name:"creation_date", value:"2013-02-22 10:04:51 +0530 (Fri, 22 Feb 2013)");
  script_cve_id("CVE-2012-5783");
  script_tag(name:"cvss_base", value:"5.8");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:M/Au:N/C:P/I:P/A:N");
  script_xref(name: "CESA", value: "2013:0270");
  script_name("CentOS Update for jakarta-commons-httpclient CESA-2013:0270 centos5 ");

  script_tag(name: "summary" , value: "Check for the Version of jakarta-commons-httpclient");
  script_category(ACT_GATHER_INFO);
  script_copyright("Copyright (c) 2013 Greenbone Networks GmbH");
  script_family("CentOS Local Security Checks");
  script_dependencies("gather-package-list.nasl");
  script_mandatory_keys("ssh/login/centos", "ssh/login/rpms");
  script_tag(name : "affected" , value : tag_affected);
  script_tag(name : "solution" , value : tag_solution);
  script_tag(name : "insight" , value : tag_insight);
  script_tag(name:"qod_type", value:"package");
  script_tag(name:"solution_type", value:"VendorFix");
  exit(0);
}


include("pkg-lib-rpm.inc");

release = get_kb_item("ssh/login/release");

res = "";
if(release == NULL){
  exit(0);
}

if(release == "CentOS5")
{

  if ((res = isrpmvuln(pkg:"jakarta-commons-httpclient", rpm:"jakarta-commons-httpclient~3.0~7jpp.2", rls:"CentOS5")) != NULL)
  {
    security_message(data:res);
    exit(0);
  }

  if ((res = isrpmvuln(pkg:"jakarta-commons-httpclient-demo", rpm:"jakarta-commons-httpclient-demo~3.0~7jpp.2", rls:"CentOS5")) != NULL)
  {
    security_message(data:res);
    exit(0);
  }

  if ((res = isrpmvuln(pkg:"jakarta-commons-httpclient-javadoc", rpm:"jakarta-commons-httpclient-javadoc~3.0~7jpp.2", rls:"CentOS5")) != NULL)
  {
    security_message(data:res);
    exit(0);
  }

  if ((res = isrpmvuln(pkg:"jakarta-commons-httpclient-manual", rpm:"jakarta-commons-httpclient-manual~3.0~7jpp.2", rls:"CentOS5")) != NULL)
  {
    security_message(data:res);
    exit(0);
  }

  if (__pkg_match) exit(99); # Not vulnerable.
  exit(0);
}

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo
22 Feb 2013 00:00Current
7.5High risk
Vulners AI Score7.5
EPSS0.002
16
.json
Report