MGASA-2015-0212 Updated async-http-client packages fix security vulnerabilities

Updated async-http-client packages fix security vulnerabilities: It was found that async-http-client would disable SSL/TLS certificate verification under certain conditions, for example if HTTPS communication also uses client certificates. This can be exploited by a Man-in-the-middle MITM attack...

Updated async-http-client packages fix security vulnerabilities

Updated async-http-client packages fix security vulnerabilities: It was found that async-http-client would disable SSL/TLS certificate verification under certain conditions, for example if HTTPS communication also uses client certificates. This can be exploited by a Man-in-the-middle MITM attack...

PT-2015-3574

Name of the Vulnerable Software and Affected Versions Async Http Client versions prior to 1.9.0 Description The issue allows man-in-the-middle attackers to spoof HTTPS servers by presenting an arbitrary certificate during use of a typical configuration, as demonstrated by a configuration that doe...

PT-2015-3575

Name of the Vulnerable Software and Affected Versions Async Http Client versions prior to 1.9.0 Description The issue allows man-in-the-middle attackers to spoof HTTPS servers via an arbitrary valid certificate because it does not require a hostname match during verification of X.509 certificates...

Fedora 20 : async-http-client-1.7.22-2.fc20 (2015-6891)

Security fix for CVE-2013-7398, CVE-2013-7397 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

Fedora Update for async-http-client FEDORA-2015-6891

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

async-http-client: SSL/TLS certificate verification is disabled under certain conditions

It was found that async-http-client would disable SSL/TLS certificate verification under certain conditions, for example if HTTPS communication also used client certificates. A man-in-the-middle MITM attacker could use this flaw to spoof a valid certificate...

async-http-client: missing hostname verification for SSL certificates

It was found that async-http-client did not verify that the server hostname matched the domain name in the subject's Common Name CN or subjectAltName field in X.509 certificates. This could allow a man-in-the-middle attacker to spoof an SSL server if they had a certificate that was valid for any...

async-http-client: SSL/TLS certificate verification is disabled under certain conditions

It was found that async-http-client would disable SSL/TLS certificate verification under certain conditions, for example if HTTPS communication also used client certificates. A man-in-the-middle MITM attacker could use this flaw to spoof a valid certificate...