Bug 1133769 (CVE-2013-7397)

Summary: CVE-2013-7397 async-http-client: SSL/TLS certificate verification is disabled under certain conditions
Product: [Other] Security Response Reporter: David Jorm <djorm>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: aileenc, alazarot, chazlett, etirelli, grocha, gvarsami, java-sig-commits, jcoleman, jrusnack, kconner, ldimaggi, lpetrovi, mbaluch, mizdebsk, mjc, msrb, mwinkler, nwallace, rrajasek, rwagner, rzhang, soa-p-jira, tcunning, tkirby, weli
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=important,public=20130730,reported=20140826,source=internet,cvss2=5.8/AV:N/AC:M/Au:N/C:P/I:P/A:N,cwe=CWE-295,fedora-all/async-http-client=affected,bpms-6/async-http-client=affected,brms-6/async-http-client=affected,jdv-6/async-http-client=affected,fsw-6/async-http-client=affected,jboss/fuse-6.1=affected,jboss/fuse-esb-7.1=affected
Fixed In Version: async-http-client 1.9.0 Doc Type: Bug Fix
Doc Text:
It was found that async-http-client would disable SSL/TLS certificate verification under certain conditions, for example if HTTPS communication also used client certificates. A man-in-the-middle (MITM) attacker could use this flaw to spoof a valid certificate.
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-08 02:34:37 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On: 1150773, 1150775, 1133789, 1150764, 1150765, 1150766, 1150767, 1150768, 1150769, 1150770, 1150771, 1150772, 1150774    
Bug Blocks: 1129969, 1210482, 1232965, 1244366    

Description David Jorm 2014-08-26 06:10:01 UTC
It was found that async-http-client would disable SSL/TLS certificate verification under certain conditions, for example if HTTPS communication also uses client certificates. This can be exploited by a Man-in-the-middle (MITM) attack where the attacker can spoof a valid certificate.

Comment 1 David Jorm 2014-08-26 07:04:10 UTC
Upstream bug:

https://github.com/AsyncHttpClient/async-http-client/issues/352

Comment 8 errata-xmlrpc 2015-04-16 16:06:36 UTC
This issue has been addressed in the following products:

  JBoss BPM Suite 6.1.0

Via RHSA-2015:0851 https://rhn.redhat.com/errata/RHSA-2015-0851.html

Comment 9 errata-xmlrpc 2015-04-16 16:11:33 UTC
This issue has been addressed in the following products:

  JBoss BRMS 6.1.0

Via RHSA-2015:0850 https://rhn.redhat.com/errata/RHSA-2015-0850.html

Comment 10 Fedora Update System 2015-05-08 07:38:31 UTC
async-http-client-1.7.22-2.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 11 errata-xmlrpc 2015-06-23 16:53:22 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Fuse 6.2.0

Via RHSA-2015:1176 https://rhn.redhat.com/errata/RHSA-2015-1176.html

Comment 12 errata-xmlrpc 2015-08-05 16:20:34 UTC
This issue has been addressed in the following products:

  JBoss Fuse Service Works 6.0.0

Via RHSA-2015:1551 https://rhn.redhat.com/errata/RHSA-2015-1551.html