Bug 1133773 (CVE-2013-7398)
| Summary: | CVE-2013-7398 async-http-client: missing hostname verification for SSL certificates | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | David Jorm <djorm> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | chazlett, grocha, jcoleman, jrusnack, kconner, mizdebsk, mjc, msrb, rzhang, soa-p-jira, weli |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | async-http-client 1.9.0 | Doc Type: | Bug Fix |
| Doc Text: |
It was found that async-http-client did not verify that the server hostname matched the domain name in the subject's Common Name (CN) or subjectAltName field in X.509 certificates. This could allow a man-in-the-middle attacker to spoof an SSL server if they had a certificate that was valid for any domain name.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-06-08 02:34:39 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1150751, 1150753, 1133787, 1150742, 1150743, 1150744, 1150745, 1150746, 1150747, 1150748, 1150749, 1150750, 1150752 | ||
| Bug Blocks: | 1129968, 1210482, 1232965, 1244366 | ||
|
Description
David Jorm
2014-08-26 06:31:17 UTC
Upstream bug: https://github.com/AsyncHttpClient/async-http-client/issues/197 Upstream patch commits: https://github.com/wsargent/async-http-client/commit/db6716ad2f10f5c2d5124904725017b2ba8c3434 https://github.com/AsyncHttpClient/async-http-client/pull/525 Created async-http-client tracking bugs for this issue: Affects: fedora-all [bug 1133787] This issue has been addressed in the following products: JBoss BPM Suite 6.1.0 Via RHSA-2015:0851 https://rhn.redhat.com/errata/RHSA-2015-0851.html This issue has been addressed in the following products: JBoss BRMS 6.1.0 Via RHSA-2015:0850 https://rhn.redhat.com/errata/RHSA-2015-0850.html async-http-client-1.7.22-2.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report. This issue has been addressed in the following products: Red Hat JBoss Fuse 6.2.0 Via RHSA-2015:1176 https://rhn.redhat.com/errata/RHSA-2015-1176.html This issue has been addressed in the following products: JBoss Fuse Service Works 6.0.0 Via RHSA-2015:1551 https://rhn.redhat.com/errata/RHSA-2015-1551.html |