http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not…
Priority LOW 29CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- —
- Confidentiality · integrity · availability
- None · Partial · None
- Fix status
- Partial Red Hat: 24 fixed, 19 without a fix
Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5783.
Why it matters now
EPSS 0.05844 93rd percentileScored 2026-11-07
Fix Partial org.apache.httpcomponents:httpclient (Maven): 4.2.3Red Hat: 27 advisoriesRed Hat: 24 fixed, 19 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.apache.httpcomponents:httpclient (Maven) | before 4.2.3 | 4.2.3 | Patch available | GHSA-2x83-r56g-cv47 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.apache.httpcomponents:httpclient (Maven) Vendor— Affected before 4.2.3 Fixed in 4.2.3 Patch available GHSA-2x83-r56g-cv47
Remediation
- Fix · GHSA-2x83-r56g-cv47 org.apache.httpcomponents:httpclient (Maven) Fixed in 4.2.3 Advisory →
Red Hat 27 advisories
- RHSA-2015:1888 Released 2015-10-12 · Red Hat rating ImportantRed Hat JBoss SOA Platform 5.3.1 security update
- Red Hat JBoss SOA Platform 5.3
- RHSA-2015:1009 Released 2015-05-14 · Red Hat rating ImportantRed Hat JBoss Portal 6.2.0 update
- Red Hat JBoss Portal 6.2
- RHSA-2015:0850 Released 2015-04-16 · Red Hat rating ImportantRed Hat JBoss BRMS 6.1.0 update
- Red Hat JBoss BRMS 6.0
Show 24 more Red Hat advisories
- RHSA-2015:0851 Released 2015-04-16 · Red Hat rating ImportantRed Hat JBoss BPM Suite 6.1.0 update
- Red Hat JBoss BPMS 6.0
- RHSA-2015:0765 Released 2015-03-31 · Red Hat rating ImportantRed Hat JBoss Data Virtualization 6.0.0 security update
- Red Hat JBoss Data Virtualization 6.0
- RHSA-2015:0720 Released 2015-03-24 · Red Hat rating ImportantRed Hat JBoss Fuse Service Works 6.0.0 security update
- Red Hat JBoss Fuse Service Works 6.0
- RHSA-2015:0675 Released 2015-03-11 · Red Hat rating ImportantRed Hat JBoss Data Virtualization 6.1.0 update
- Red Hat JBoss Data Virtualization 6.1
- RHSA-2015:0234 Released 2015-02-17 · Red Hat rating ImportantRed Hat JBoss BPM Suite 6.0.3 security update
- Red Hat JBoss BPMS 6.0
- RHSA-2015:0235 Released 2015-02-17 · Red Hat rating ImportantRed Hat JBoss BRMS 6.0.3 security update
- Red Hat JBoss BRMS 6.0
- RHSA-2015:0158 Released 2015-02-11 · Red Hat rating ImportantRed Hat Enterprise Virtualization Manager 3.5.0
- RHEV-M 3.5 rhevm-3.5.0-0.29.el6ev, rhevm-backend-3.5.0-0.29.el6ev, rhevm-dbscripts-3.5.0-0.29.el6ev +14
- RHSA-2015:0125 Released 2015-02-04 · Red Hat rating ImportantRed Hat JBoss Web Framework Kit 2.7.0 update
- Red Hat JBoss Web Framework Kit 2.7
- RHSA-2014:2019 Released 2014-12-18 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 6.3.2 security update
- Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 5 Server apache-cxf-2.7.12-1.SP1_redhat_5.1.ep6.el5, wss4j-1.6.16-2.redhat_3.1.ep6.el5
- Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 6 Server apache-cxf-2.7.12-1.SP1_redhat_5.1.ep6.el6, wss4j-1.6.16-2.redhat_3.1.ep6.el6
- Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 7 Server apache-cxf-2.7.12-1.SP1_redhat_5.1.ep6.el7, wss4j-1.6.16-2.redhat_3.1.ep6.el7
- RHSA-2014:2020 Released 2014-12-18 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 6.3.2 security update
- Red Hat JBoss Enterprise Application Platform 6.3
- RHSA-2014:1904 Released 2014-11-25 · Red Hat rating ImportantRed Hat JBoss Operations Network 3.3.0 update
- Red Hat JBoss Operations Network 3.3
- RHSA-2014:1891 Released 2014-11-24 · Red Hat rating ImportantRed Hat JBoss BRMS 6.0.3 security update
- Red Hat JBoss BRMS 6.0
- RHSA-2014:1892 Released 2014-11-24 · Red Hat rating ImportantRed Hat JBoss BPM Suite 6.0.3 update
- Red Hat JBoss BPMS 6.0
- RHSA-2014:1833 Released 2014-11-10 · Red Hat rating ImportantRed Hat JBoss Enterprise Web Platform 5.2.0 security update
- Red Hat JBoss Web Platform 5 for RHEL 5 Server apache-cxf-2.2.12-14.patch_09.ep5.el5
- Red Hat JBoss Web Platform 5 for RHEL 6 Server apache-cxf-2.2.12-14.patch_09.el6
- RHSA-2014:1834 Released 2014-11-10 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 5.2.0 security update
- Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS apache-cxf-2.2.12-14.patch_09.ep5.el4
- Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES apache-cxf-2.2.12-14.patch_09.ep5.el4
- Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server apache-cxf-2.2.12-14.patch_09.ep5.el5
- Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server apache-cxf-2.2.12-14.patch_09.el6
- RHSA-2014:1835 Released 2014-11-10 · Red Hat rating ImportantRed Hat JBoss Enterprise Web Platform 5.2.0 security update
- Red Hat JBoss Web Platform 5.2
- RHSA-2014:1836 Released 2014-11-10 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 5.2.0 security update
- Red Hat JBoss Enterprise Application Platform 5.2
- RHSA-2014:1321 Released 2014-09-29 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 5.2.0 security update
- Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4, jboss-seam2-2.2.6.EAP5-22_patch_01.ep5.el4, jboss-seam2-docs-2.2.6.EAP5-22_patch_01.ep5.el4 +2
- Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4, jboss-seam2-2.2.6.EAP5-22_patch_01.ep5.el4, jboss-seam2-docs-2.2.6.EAP5-22_patch_01.ep5.el4 +2
- Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5, jboss-seam2-2.2.6.EAP5-22_patch_01.ep5.el5, jboss-seam2-docs-2.2.6.EAP5-22_patch_01.ep5.el5 +2
- Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5, jboss-seam2-2.2.6.EAP5-22_patch_01.el6, jboss-seam2-docs-2.2.6.EAP5-22_patch_01.el6 +2
- RHSA-2014:1323 Released 2014-09-29 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 5.2.0 security update
- Red Hat JBoss Enterprise Application Platform 5.2
- RHSA-2014:1320 Released 2014-09-29 · Red Hat rating ImportantRed Hat JBoss Enterprise Web Platform 5.2.0 security update
- Red Hat JBoss Web Platform 5 for RHEL 5 Server jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5, jboss-seam2-2.2.6.EAP5-22_patch_01.ep5.el5, jboss-seam2-docs-2.2.6.EAP5-22_patch_01.ep5.el5 +2
- Red Hat JBoss Web Platform 5 for RHEL 6 Server jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5, jboss-seam2-2.2.6.EAP5-22_patch_01.el6, jboss-seam2-docs-2.2.6.EAP5-22_patch_01.el6 +2
- RHSA-2014:1322 Released 2014-09-29 · Red Hat rating ImportantRed Hat JBoss Enterprise Web Platform 5.2.0 security update
- Red Hat JBoss Web Platform 5.2
- RHSA-2014:1162 Released 2014-09-04 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 6.3.0 security update
- Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 5 Server httpclient-eap6-4.2.1-12.redhat_2.1.ep6.el5, httpcomponents-client-eap6-4.2.1-12.redhat_2.1.ep6.el5, httpcomponents-core-eap6-4.2.1-12.redhat_2.1.ep6.el5 +4
- Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 6 Server httpclient-eap6-4.2.1-12.redhat_2.1.ep6.el6, httpcomponents-client-eap6-4.2.1-12.redhat_2.1.ep6.el6, httpcomponents-core-eap6-4.2.1-12.redhat_2.1.ep6.el6 +4
- Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 7 Server httpclient-eap6-4.2.1-12.redhat_2.1.ep6.el7, httpcomponents-client-eap6-4.2.1-12.redhat_2.1.ep6.el7, httpcomponents-core-eap6-4.2.1-12.redhat_2.1.ep6.el7 +4
- RHSA-2014:1163 Released 2014-09-04 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 6.3.0 security update
- Red Hat JBoss Enterprise Application Platform 6.3
- RHSA-2014:1098 Released 2014-08-26 · Red Hat rating Importantdevtoolset-2-httpcomponents-client security update
- Red Hat Developer Toolset 2 for Red Hat Enterprise Linux 6 Server devtoolset-2-httpcomponents-client-4.2.1-6.el6, devtoolset-2-httpcomponents-client-javadoc-4.2.1-6.el6
- Red Hat Developer Toolset 2 for Red Hat Enterprise Linux 6 Workstation devtoolset-2-httpcomponents-client-4.2.1-6.el6, devtoolset-2-httpcomponents-client-javadoc-4.2.1-6.el6
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Enterprise 1 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Virtualization 3 | Affected | No fix yet |
| Red Hat JBoss BRMS 5 | Affected | No fix yet |
| Red Hat JBoss Data Grid 6 | Affected | No fix yet |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix yet |
| Red Hat JBoss Enterprise Application Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Enterprise Application Platform 5 | Affected | No fix yet |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix yet |
| Red Hat JBoss Enterprise Web Server 1 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix yet |
| Red Hat JBoss Operations Network 3 | Affected | No fix yet |
| Red Hat JBoss Portal 5 | Affected | No fix yet |
| Red Hat JBoss Portal 6 | Affected | No fix yet |
| Red Hat JBoss SOA Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Enterprise 2 | Affected | No fix yet |
| Red Hat Satellite 5 | Affected | No fix yet |
| Red Hat Satellite 6 | Affected | No fix yet |
| Red Hat Storage 2 | Affected | No fix planned: Will not fix |
| Red Hat Storage 3 | Affected | No fix planned: Will not fix |
| RHEV-M 3.5 | Fixed | RHSA-2015:0158 |
| Red Hat Developer Toolset 2 for Red Hat Enterprise Linux 6 Server | Fixed | RHSA-2014:1098 |
| Red Hat Developer Toolset 2 for Red Hat Enterprise Linux 6 Workstation | Fixed | RHSA-2014:1098 |
| Red Hat JBoss BPMS 6.0 | Fixed | RHSA-2015:0234 |
| Red Hat JBoss BRMS 6.0 | Fixed | RHSA-2015:0235 |
| Red Hat JBoss Data Virtualization 6.0 | Fixed | RHSA-2015:0765 |
| Red Hat JBoss Data Virtualization 6.1 | Fixed | RHSA-2015:0675 |
| Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS | Fixed | RHSA-2014:1321, RHSA-2014:1834 |
| Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES | Fixed | RHSA-2014:1321, RHSA-2014:1834 |
| Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server | Fixed | RHSA-2014:1321, RHSA-2014:1834 |
| Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server | Fixed | RHSA-2014:1321, RHSA-2014:1834 |
| Red Hat JBoss Enterprise Application Platform 5.2 | Fixed | RHSA-2014:1836 |
| Red Hat JBoss Enterprise Application Platform 6.3 | Fixed | RHSA-2014:2020 |
| Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 5 Server | Fixed | RHSA-2014:1162, RHSA-2014:2019 |
| Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 6 Server | Fixed | RHSA-2014:1162, RHSA-2014:2019 |
| Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 7 Server | Fixed | RHSA-2014:1162, RHSA-2014:2019 |
| Red Hat JBoss Fuse Service Works 6.0 | Fixed | RHSA-2015:0720 |
| Red Hat JBoss Operations Network 3.3 | Fixed | RHSA-2014:1904 |
| Red Hat JBoss Portal 6.2 | Fixed | RHSA-2015:1009 |
| Red Hat JBoss SOA Platform 5.3 | Fixed | RHSA-2015:1888 |
| Red Hat JBoss Web Framework Kit 2.7 | Fixed | RHSA-2015:0125 |
| Red Hat JBoss Web Platform 5 for RHEL 5 Server | Fixed | RHSA-2014:1320, RHSA-2014:1833 |
| Red Hat JBoss Web Platform 5 for RHEL 6 Server | Fixed | RHSA-2014:1320, RHSA-2014:1833 |
| Red Hat JBoss Web Platform 5.2 | Fixed | RHSA-2014:1835 |
Not affected: 8 products
- OpenShift Enterprise 1
- Red Hat Enterprise Linux 5
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat JBoss Web Platform 5 for RHEL 4 AS
- Red Hat JBoss Web Platform 5 for RHEL 4 ES
- Red Hat OpenShift Enterprise 2
- Red Hat Software Collections
Timeline
- 2026-10-02 Threatist record created from CVE-2012-6153
- 2026-10-03 Alias added: GHSA-2x83-r56g-cv47
References
Advisory 22
- RHSA-2014:1891
- RHSA-2015:0765
- https://access.redhat.com/solutions/1165533
- RHSA-2015:0675
- RHSA-2014:1098
- RHSA-2015:0720
- RHSA-2015:1888
- RHSA-2014:1833
- RHSA-2015:0850
- RHSA-2015:0158
- RHSA-2014:1834
- http://svn.apache.org/viewvc?view=revision&revision=1411705
- RHSA-2015:0125
- https://bugzilla.redhat.com/show_bug.cgi?id=1129916
- RHSA-2014:1892
- RHSA-2015:0851
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05103564
- RHSA-2014:1835
- USN-2769-1
- RHSA-2014:1836
- https://nvd.nist.gov/vuln/detail/CVE-2012-6153
- https://github.com/advisories/GHSA-2x83-r56g-cv47
Sources
- CVE-2012-6153 · CVE Program
- CVE-2012-6153 · NVD
- FIRST EPSS
- GHSA-2x83-r56g-cv47 · GitHub Advisory Database · CC BY 4.0
- CVE-2012-6153 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences