Red Hat Security AdvisoryRHSA-2014:1162
Red Hat JBoss Enterprise Application Platform 6.3.0 security update
Released 2014-09-04 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 5 Server httpclient-eap6-4.2.1-12.redhat_2.1.ep6.el5, httpcomponents-client-eap6-4.2.1-12.redhat_2.1.ep6.el5, httpcomponents-core-eap6-4.2.1-12.redhat_2.1.ep6.el5 +4
- Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 6 Server httpclient-eap6-4.2.1-12.redhat_2.1.ep6.el6, httpcomponents-client-eap6-4.2.1-12.redhat_2.1.ep6.el6, httpcomponents-core-eap6-4.2.1-12.redhat_2.1.ep6.el6 +4
- Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 7 Server httpclient-eap6-4.2.1-12.redhat_2.1.ep6.el7, httpcomponents-client-eap6-4.2.1-12.redhat_2.1.ep6.el7, httpcomponents-core-eap6-4.2.1-12.redhat_2.1.ep6.el7 +4
Fixes 2 records
Priority LOW 38
org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common…
CVSS 2.0MEDIUM 5.8· Network · No auth · Interaction — · EPSS 0.09189 · Published 2014-08-21 · Partial fix · 4.3.5 CWE-347
Priority LOW 29
http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.05844 · Published 2014-09-04 · Partial fix · 4.2.3 CWE-20
