Bug 873253 (CVE-2012-5785)

Summary:	CVE-2012-5785 axis2: Does not verify that the server hostname matches a domain name in the subject's CN or subjectAltName field of the x.509 certificate
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	agrimm, djorm
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-11-06 01:17:18 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	873288
Bug Blocks:	873290

Description Jan Lieskovsky 2012-11-05 13:07:10 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2012-5785 to the following vulnerability:

Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

References:
[1] http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
[2] https://crypto.stanford.edu/~dabo/pubs/abstracts/ssl-client-bugs.html
[3] http://www.sigsac.org/ccs/CCS2012/techprogram.shtml

Comment 1 Jan Lieskovsky 2012-11-05 13:52:17 UTC

Created axis2 tracking bugs for this issue

Affects: fedora-17 [bug 873288]

Comment 2 David Jorm 2012-11-06 01:17:18 UTC

Statement:

Not vulnerable. This issue only affects axis2 as shipped with Fedora. It does not affect components shipped with any Red Hat products.