CVE Feed

Dashboard / CVE / CVE-2014-3577

CVE-2014-3577

org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field.

Published:Aug 18, 2014

Last Modified:Apr 12, 2025

EPS:Aug 21, 2014

EPSS Score:0.01367

CVSS Score:4.8

Affected Products

Vendor

Product

Action

Vendor

Apache

Product

Httpasyncclient

Apache

Httpasyncclient

Vendor

Apache

Product

Httpclient

Apache

Httpclient

Vendor

Redhat

Product

Enterprise Linux

Redhat

Enterprise Linux

Vendor

Redhat

Product

Jboss Amq

Redhat

Jboss Amq

Vendor

Redhat

Product

Jboss Bpms

Redhat

Jboss Bpms

Vendor

Redhat

Product

Jboss Brms

Redhat

Jboss Brms

Vendor

Redhat

Product

Jboss Data Virtualization

Redhat

Jboss Data Virtualization

Vendor

Redhat

Product

Jboss Enterprise Application Platform

Redhat

Jboss Enterprise Application Platform

Vendor

Redhat

Product

Jboss Enterprise Portal Platform

Redhat

Jboss Enterprise Portal Platform

Vendor

Redhat

Product

Jboss Enterprise Soa Platform

Redhat

Jboss Enterprise Soa Platform

Vendor

Redhat

Product

Jboss Enterprise Web Framework

Redhat

Jboss Enterprise Web Framework

Vendor

Redhat

Product

Jboss Enterprise Web Platform

Redhat

Jboss Enterprise Web Platform

Vendor

Redhat

Product

Jboss Fuse

Redhat

Jboss Fuse

Vendor

Redhat

Product

Jboss Fuse Service Works

Redhat

Jboss Fuse Service Works

Vendor

Redhat

Product

Jboss Operations Network

Redhat

Jboss Operations Network

Vendor

Redhat

Product

Openshift

Redhat

Openshift

Vendor

Redhat

Product

Rhel Software Collections

Redhat

Rhel Software Collections

Vendor

Redhat

Product

Rhev Manager

Redhat

Rhev Manager

Exploits

http://packetstormsecurity.com/files/127913/Apache-HttpComponents-Man-In-The-Middle.html http://seclists.org/fulldisclosure/2014/Aug/48 http://packetstormsecurity.com/files/127913/Apache-HttpComponents-Man-In-The-Middle.html http://seclists.org/fulldisclosure/2014/Aug/48

Common Weakness Enumeration

CWE-297 Improper Validation of Certificate with Host Mismatch

Common Attack Pattern Enumeration and Classification (CAPEC)

No CAPEC recorded yet

References

http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00032.html

http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00033.html

http://packetstormsecurity.com/files/127913/Apache-HttpComponents-Man-In-The-Middle.html

http://rhn.redhat.com/errata/RHSA-2014-1146.html

http://rhn.redhat.com/errata/RHSA-2014-1166.html

http://rhn.redhat.com/errata/RHSA-2014-1833.html

http://rhn.redhat.com/errata/RHSA-2014-1834.html

http://rhn.redhat.com/errata/RHSA-2014-1835.html

http://rhn.redhat.com/errata/RHSA-2014-1836.html

http://rhn.redhat.com/errata/RHSA-2014-1891.html

http://rhn.redhat.com/errata/RHSA-2014-1892.html

http://rhn.redhat.com/errata/RHSA-2015-0125.html

http://rhn.redhat.com/errata/RHSA-2015-0158.html

http://rhn.redhat.com/errata/RHSA-2015-0675.html

http://rhn.redhat.com/errata/RHSA-2015-0720.html

http://rhn.redhat.com/errata/RHSA-2015-0765.html

http://rhn.redhat.com/errata/RHSA-2015-0850.html

http://rhn.redhat.com/errata/RHSA-2015-0851.html

http://rhn.redhat.com/errata/RHSA-2015-1176.html

http://rhn.redhat.com/errata/RHSA-2015-1177.html

http://rhn.redhat.com/errata/RHSA-2015-1888.html

http://rhn.redhat.com/errata/RHSA-2016-1773.html

http://rhn.redhat.com/errata/RHSA-2016-1931.html

http://seclists.org/fulldisclosure/2014/Aug/48

http://secunia.com/advisories/60466

http://secunia.com/advisories/60589

http://secunia.com/advisories/60713

http://www.openwall.com/lists/oss-security/2021/10/06/1

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

http://www.osvdb.org/110143

http://www.securityfocus.com/bid/69258

http://www.securitytracker.com/id/1030812

http://www.ubuntu.com/usn/USN-2769-1

https://access.redhat.com/solutions/1165533

https://exchange.xforce.ibmcloud.com/vulnerabilities/95327

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05103564

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05363782

https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E

https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E

https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E

https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E

https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E

https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E

https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E

https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E

https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E

https://security.netapp.com/advisory/ntap-20231027-0003/

http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00032.html

http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00033.html

http://packetstormsecurity.com/files/127913/Apache-HttpComponents-Man-In-The-Middle.html

http://rhn.redhat.com/errata/RHSA-2014-1146.html

http://rhn.redhat.com/errata/RHSA-2014-1166.html

http://rhn.redhat.com/errata/RHSA-2014-1833.html

http://rhn.redhat.com/errata/RHSA-2014-1834.html

http://rhn.redhat.com/errata/RHSA-2014-1835.html

http://rhn.redhat.com/errata/RHSA-2014-1836.html

http://rhn.redhat.com/errata/RHSA-2014-1891.html

http://rhn.redhat.com/errata/RHSA-2014-1892.html

http://rhn.redhat.com/errata/RHSA-2015-0125.html

http://rhn.redhat.com/errata/RHSA-2015-0158.html

http://rhn.redhat.com/errata/RHSA-2015-0675.html

http://rhn.redhat.com/errata/RHSA-2015-0720.html

http://rhn.redhat.com/errata/RHSA-2015-0765.html

http://rhn.redhat.com/errata/RHSA-2015-0850.html

http://rhn.redhat.com/errata/RHSA-2015-0851.html

http://rhn.redhat.com/errata/RHSA-2015-1176.html

http://rhn.redhat.com/errata/RHSA-2015-1177.html

http://rhn.redhat.com/errata/RHSA-2015-1888.html

http://rhn.redhat.com/errata/RHSA-2016-1773.html

http://rhn.redhat.com/errata/RHSA-2016-1931.html

http://seclists.org/fulldisclosure/2014/Aug/48

http://secunia.com/advisories/60466

http://secunia.com/advisories/60589

http://secunia.com/advisories/60713

http://www.openwall.com/lists/oss-security/2021/10/06/1

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

http://www.osvdb.org/110143

http://www.securityfocus.com/bid/69258

http://www.securitytracker.com/id/1030812

http://www.ubuntu.com/usn/USN-2769-1

https://access.redhat.com/solutions/1165533

https://exchange.xforce.ibmcloud.com/vulnerabilities/95327

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05103564

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05363782

https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E

https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E

https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E

https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E

https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E

https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E

https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E

https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E

https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E

https://security.netapp.com/advisory/ntap-20231027-0003/

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High