PT-2014-2058

Name of the Vulnerable Software and Affected Versions Apache HttpComponents HttpClient versions prior to 4.3.5 Apache HttpComponents HttpAsyncClient versions prior to 4.0.2 Description The issue is related to improper verification of SSL/TLS certificate authentication in the Apache HttpClient...

CVE-2014-3577: Apache HttpComponents client: Hostname verification susceptible to MITM attack

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Security Advisory - Apache Software Foundation Apache HttpComponents / hc.apache.org Hostname verification susceptible to MITM attack CVE-2014-3577 / CVSS 1.4 Apache HttpComponents prior to revision 4.3.5/4.0.2 may be susceptible to a 'Man in the Midd...

PT-2012-1252

Name of the Vulnerable Software and Affected Versions Apache Commons HttpClient versions prior to 4.2.3 Description The issue is related to insufficient verification of input data in the Apache Commons HttpClient library, part of Apache HttpComponents. This allows a remote attacker to spoof SSL...

Authorization

Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Authorization header to the origin server, which allows remote web servers to obtain sensitive information by logging this header...

CVE-2011-1498

Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Authorization header to the origin server, which allows remote web servers to obtain sensitive information by logging this header...

CVE-2011-1498

Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Authorization header to the origin server, which allows remote web servers to obtain sensitive information by logging this header...