Bug 1133769 (CVE-2013-7397)

Summary:	CVE-2013-7397 async-http-client: SSL/TLS certificate verification is disabled under certain conditions
Product:	[Other] Security Response	Reporter:	David Jorm <djorm>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aileenc, alazarot, chazlett, etirelli, grocha, gvarsami, java-sig-commits, jcoleman, jrusnack, kconner, ldimaggi, lpetrovi, mbaluch, mizdebsk, mjc, msrb, mwinkler, nwallace, rrajasek, rwagner, rzhang, soa-p-jira, tcunning, tkirby, weli
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	async-http-client 1.9.0	Doc Type:	Bug Fix
Doc Text:	It was found that async-http-client would disable SSL/TLS certificate verification under certain conditions, for example if HTTPS communication also used client certificates. A man-in-the-middle (MITM) attacker could use this flaw to spoof a valid certificate.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-08 02:34:37 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1150773, 1150775, 1133789, 1150764, 1150765, 1150766, 1150767, 1150768, 1150769, 1150770, 1150771, 1150772, 1150774
Bug Blocks:	1129969, 1210482, 1232965, 1244366

Description David Jorm 2014-08-26 06:10:01 UTC

It was found that async-http-client would disable SSL/TLS certificate verification under certain conditions, for example if HTTPS communication also uses client certificates. This can be exploited by a Man-in-the-middle (MITM) attack where the attacker can spoof a valid certificate.

Comment 1 David Jorm 2014-08-26 07:04:10 UTC

Upstream bug:

https://github.com/AsyncHttpClient/async-http-client/issues/352

Comment 8 errata-xmlrpc 2015-04-16 16:06:36 UTC

This issue has been addressed in the following products:

  JBoss BPM Suite 6.1.0

Via RHSA-2015:0851 https://rhn.redhat.com/errata/RHSA-2015-0851.html

Comment 9 errata-xmlrpc 2015-04-16 16:11:33 UTC

This issue has been addressed in the following products:

  JBoss BRMS 6.1.0

Via RHSA-2015:0850 https://rhn.redhat.com/errata/RHSA-2015-0850.html

Comment 10 Fedora Update System 2015-05-08 07:38:31 UTC

async-http-client-1.7.22-2.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 11 errata-xmlrpc 2015-06-23 16:53:22 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Fuse 6.2.0

Via RHSA-2015:1176 https://rhn.redhat.com/errata/RHSA-2015-1176.html

Comment 12 errata-xmlrpc 2015-08-05 16:20:34 UTC

This issue has been addressed in the following products:

  JBoss Fuse Service Works 6.0.0

Via RHSA-2015:1551 https://rhn.redhat.com/errata/RHSA-2015-1551.html