Red Hat Security Advisory

RHSA-2015:1551

Red Hat JBoss Fuse Service Works 6.0.0 security update

Released 2015-08-05 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat JBoss Fuse Service Works 6.0

Fixes 2 records

TI-2013-06061 CVE-2013-7398 · GHSA-5c66-6h6g-6q6m

main/java/com/ning/http/client/AsyncHttpClientConfig.java in Async Http Client (aka AHC…

LOW 22

main/java/com/ning/http/client/AsyncHttpClientConfig.java in Async Http Client (aka AHC or async-http-client) before 1.9.0 does not require a hostname match during verification of X.509 certificates, which allows man-in-…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.0083 Published 2015-06-24 Partial fix · 1.9.0 CWE-345

TI-2013-06060 CVE-2013-7397 · GHSA-8h53-fjgg-g42g

Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate…

LOW 22

Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, which allows man-in-the-middle attackers to…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.00993 Published 2015-06-24 Partial fix · 1.9.0 CWE-345