Read the docs
TI-2014-02901 Aliases CVE-2014-3577GHSA-cfh5-3ghh-wfjx

org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before…

Priority LOW 38CWE-347Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Security bypass
Confidentiality · integrity · availability
Partial · Partial · None
Fix status
Partial Red Hat: 50 fixed, 21 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-347.

Summary

org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field.

Why it matters now

EPSS 0.09189 95th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Partial org.apache.httpcomponents:httpclient (Maven): 4.3.5Red Hat: 34 advisoriesRed Hat: 50 fixed, 21 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.apache.httpcomponents:httpclient (Maven)before 4.3.54.3.5Patch availableGHSA-cfh5-3ghh-wfjx
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.apache.httpcomponents:httpclient (Maven) Vendor— Affected before 4.3.5 Fixed in 4.3.5 Patch available GHSA-cfh5-3ghh-wfjx

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:apache:httpclient:*:*:*:*:*:*:*:*4.0 – 4.3.4VulnerableApache
cpe:2.3:a:apache:httpasyncclient:*:*:*:*:*:*:*:*4.0 – 4.0.1VulnerableApache
  • cpe:2.3:a:apache:httpclient:*:*:*:*:*:*:*:* Versions 4.0 – 4.3.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:httpasyncclient:*:*:*:*:*:*:*:* Versions 4.0 – 4.0.1 Vulnerable ·Apache

Remediation

  • Fix · GHSA-cfh5-3ghh-wfjx org.apache.httpcomponents:httpclient (Maven) Fixed in 4.3.5 Advisory →

Red Hat 34 advisories

  • RHSA-2022:0055 Released 2022-03-10 · Red Hat rating Moderate
    OpenShift Container Platform 4.10.3 bug fix and security update
    • Red Hat OpenShift Container Platform 4.10 coreos-installer-0.12.0-1.rhaos4.10.el8, coreos-installer-bootinfra-0.12.0-1.rhaos4.10.el8, cri-o-1.23.0-92.rhaos4.10.gitdaab4d1.el7 +11
  • RHSA-2016:1931 Released 2016-09-23 · Red Hat rating Important
    Red Hat JBoss Fuse/A-MQ 6.2.1 security and bug fix update
    • Red Hat JBoss A-MQ 6.2
    • Red Hat JBoss Fuse 6.2
  • RHSA-2016:1773 Released 2016-08-24 · Red Hat rating Important
    Red Hat OpenShift Enterprise 2.2.10 security, bug fix, and enhancement update
    • Red Hat OpenShift Enterprise Client 2.2 rhc-1.38.7.1-1.el6op
    • Red Hat OpenShift Enterprise Infrastructure 2.2 activemq-5.9.0-6.redhat.611463.el6op, activemq-client-5.9.0-6.redhat.611463.el6op, openshift-origin-broker-1.16.3.2-1.el6op +5
    • Red Hat OpenShift Enterprise JBoss EAP add-on 2.2 openshift-origin-cartridge-jbosseap-2.27.4.2-1.el6op
    • Red Hat OpenShift Enterprise Node 2.2 ImageMagick-6.7.2.7-5.el6_8, ImageMagick-devel-6.7.2.7-5.el6_8, ImageMagick-doc-6.7.2.7-5.el6_8 +24
Show 31 more Red Hat advisories
  • RHSA-2015:1888 Released 2015-10-12 · Red Hat rating Important
    Red Hat JBoss SOA Platform 5.3.1 security update
    • Red Hat JBoss SOA Platform 5.3
  • RHSA-2015:1176 Released 2015-06-23 · Red Hat rating Important
    Red Hat JBoss Fuse 6.2.0 update
    • Red Hat JBoss Fuse 6.2
  • RHSA-2015:1177 Released 2015-06-23 · Red Hat rating Important
    Red Hat JBoss A-MQ 6.2.0 update
    • Red Hat JBoss A-MQ 6.2
  • RHSA-2015:1009 Released 2015-05-14 · Red Hat rating Important
    Red Hat JBoss Portal 6.2.0 update
    • Red Hat JBoss Portal 6.2
  • RHSA-2015:0850 Released 2015-04-16 · Red Hat rating Important
    Red Hat JBoss BRMS 6.1.0 update
    • Red Hat JBoss BRMS 6.0
  • RHSA-2015:0851 Released 2015-04-16 · Red Hat rating Important
    Red Hat JBoss BPM Suite 6.1.0 update
    • Red Hat JBoss BPMS 6.0
  • RHSA-2015:0765 Released 2015-03-31 · Red Hat rating Important
    Red Hat JBoss Data Virtualization 6.0.0 security update
    • Red Hat JBoss Data Virtualization 6.0
  • RHSA-2015:0720 Released 2015-03-24 · Red Hat rating Important
    Red Hat JBoss Fuse Service Works 6.0.0 security update
    • Red Hat JBoss Fuse Service Works 6.0
  • RHSA-2015:0675 Released 2015-03-11 · Red Hat rating Important
    Red Hat JBoss Data Virtualization 6.1.0 update
    • Red Hat JBoss Data Virtualization 6.1
  • RHSA-2015:0234 Released 2015-02-17 · Red Hat rating Important
    Red Hat JBoss BPM Suite 6.0.3 security update
    • Red Hat JBoss BPMS 6.0
  • RHSA-2015:0235 Released 2015-02-17 · Red Hat rating Important
    Red Hat JBoss BRMS 6.0.3 security update
    • Red Hat JBoss BRMS 6.0
  • RHSA-2015:0158 Released 2015-02-11 · Red Hat rating Important
    Red Hat Enterprise Virtualization Manager 3.5.0
    • RHEV-M 3.5 rhevm-3.5.0-0.29.el6ev, rhevm-backend-3.5.0-0.29.el6ev, rhevm-dbscripts-3.5.0-0.29.el6ev +14
  • RHSA-2015:0125 Released 2015-02-04 · Red Hat rating Important
    Red Hat JBoss Web Framework Kit 2.7.0 update
    • Red Hat JBoss Web Framework Kit 2.7
  • RHSA-2014:2019 Released 2014-12-18 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.3.2 security update
    • Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 5 Server apache-cxf-2.7.12-1.SP1_redhat_5.1.ep6.el5, wss4j-1.6.16-2.redhat_3.1.ep6.el5
    • Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 6 Server apache-cxf-2.7.12-1.SP1_redhat_5.1.ep6.el6, wss4j-1.6.16-2.redhat_3.1.ep6.el6
    • Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 7 Server apache-cxf-2.7.12-1.SP1_redhat_5.1.ep6.el7, wss4j-1.6.16-2.redhat_3.1.ep6.el7
  • RHSA-2014:2020 Released 2014-12-18 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.3.2 security update
    • Red Hat JBoss Enterprise Application Platform 6.3
  • RHSA-2014:1904 Released 2014-11-25 · Red Hat rating Important
    Red Hat JBoss Operations Network 3.3.0 update
    • Red Hat JBoss Operations Network 3.3
  • RHSA-2014:1891 Released 2014-11-24 · Red Hat rating Important
    Red Hat JBoss BRMS 6.0.3 security update
    • Red Hat JBoss BRMS 6.0
  • RHSA-2014:1892 Released 2014-11-24 · Red Hat rating Important
    Red Hat JBoss BPM Suite 6.0.3 update
    • Red Hat JBoss BPMS 6.0
  • RHSA-2014:1833 Released 2014-11-10 · Red Hat rating Important
    Red Hat JBoss Enterprise Web Platform 5.2.0 security update
    • Red Hat JBoss Web Platform 5 for RHEL 5 Server apache-cxf-2.2.12-14.patch_09.ep5.el5
    • Red Hat JBoss Web Platform 5 for RHEL 6 Server apache-cxf-2.2.12-14.patch_09.el6
  • RHSA-2014:1834 Released 2014-11-10 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 5.2.0 security update
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS apache-cxf-2.2.12-14.patch_09.ep5.el4
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES apache-cxf-2.2.12-14.patch_09.ep5.el4
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server apache-cxf-2.2.12-14.patch_09.ep5.el5
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server apache-cxf-2.2.12-14.patch_09.el6
  • RHSA-2014:1835 Released 2014-11-10 · Red Hat rating Important
    Red Hat JBoss Enterprise Web Platform 5.2.0 security update
    • Red Hat JBoss Web Platform 5.2
  • RHSA-2014:1836 Released 2014-11-10 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 5.2.0 security update
    • Red Hat JBoss Enterprise Application Platform 5.2
  • RHSA-2014:1321 Released 2014-09-29 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 5.2.0 security update
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4, jboss-seam2-2.2.6.EAP5-22_patch_01.ep5.el4, jboss-seam2-docs-2.2.6.EAP5-22_patch_01.ep5.el4 +2
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4, jboss-seam2-2.2.6.EAP5-22_patch_01.ep5.el4, jboss-seam2-docs-2.2.6.EAP5-22_patch_01.ep5.el4 +2
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5, jboss-seam2-2.2.6.EAP5-22_patch_01.ep5.el5, jboss-seam2-docs-2.2.6.EAP5-22_patch_01.ep5.el5 +2
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5, jboss-seam2-2.2.6.EAP5-22_patch_01.el6, jboss-seam2-docs-2.2.6.EAP5-22_patch_01.el6 +2
  • RHSA-2014:1323 Released 2014-09-29 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 5.2.0 security update
    • Red Hat JBoss Enterprise Application Platform 5.2
  • RHSA-2014:1320 Released 2014-09-29 · Red Hat rating Important
    Red Hat JBoss Enterprise Web Platform 5.2.0 security update
    • Red Hat JBoss Web Platform 5 for RHEL 5 Server jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5, jboss-seam2-2.2.6.EAP5-22_patch_01.ep5.el5, jboss-seam2-docs-2.2.6.EAP5-22_patch_01.ep5.el5 +2
    • Red Hat JBoss Web Platform 5 for RHEL 6 Server jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5, jboss-seam2-2.2.6.EAP5-22_patch_01.el6, jboss-seam2-docs-2.2.6.EAP5-22_patch_01.el6 +2
  • RHSA-2014:1322 Released 2014-09-29 · Red Hat rating Important
    Red Hat JBoss Enterprise Web Platform 5.2.0 security update
    • Red Hat JBoss Web Platform 5.2
  • RHSA-2014:1166 Released 2014-09-08 · Red Hat rating Important
    jakarta-commons-httpclient security update
    • Red Hat Enterprise Linux (v. 5 server) jakarta-commons-httpclient-1:3.0-7jpp.4.el5_10, jakarta-commons-httpclient-1:3.0-7jpp.4.el5_10.i386, jakarta-commons-httpclient-1:3.0-7jpp.4.el5_10.ia64 +13
    • Red Hat Enterprise Linux Client (v. 7) jakarta-commons-httpclient-1:3.1-16.el7_0
    • Red Hat Enterprise Linux Client Optional (v. 7) jakarta-commons-httpclient-demo-1:3.1-16.el7_0, jakarta-commons-httpclient-javadoc-1:3.1-16.el7_0, jakarta-commons-httpclient-manual-1:3.1-16.el7_0
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) jakarta-commons-httpclient-1:3.1-16.el7_0, jakarta-commons-httpclient-demo-1:3.1-16.el7_0, jakarta-commons-httpclient-javadoc-1:3.1-16.el7_0 +1
    • Red Hat Enterprise Linux Desktop (v. 5 client) jakarta-commons-httpclient-1:3.0-7jpp.4.el5_10, jakarta-commons-httpclient-1:3.0-7jpp.4.el5_10.i386
    • Red Hat Enterprise Linux Desktop (v. 6) jakarta-commons-httpclient-1:3.1-0.9.el6_5
    • Red Hat Enterprise Linux Desktop Optional (v. 6) jakarta-commons-httpclient-1:3.1-0.9.el6_5, jakarta-commons-httpclient-demo-1:3.1-0.9.el6_5, jakarta-commons-httpclient-javadoc-1:3.1-0.9.el6_5 +1
    • Red Hat Enterprise Linux Desktop Workstation (v. 5 client) jakarta-commons-httpclient-1:3.0-7jpp.4.el5_10, jakarta-commons-httpclient-demo-1:3.0-7jpp.4.el5_10, jakarta-commons-httpclient-demo-1:3.0-7jpp.4.el5_10.i386 +4
    • Red Hat Enterprise Linux HPC Node (v. 6) jakarta-commons-httpclient-1:3.1-0.9.el6_5
    • Red Hat Enterprise Linux HPC Node Optional (v. 6) jakarta-commons-httpclient-1:3.1-0.9.el6_5, jakarta-commons-httpclient-demo-1:3.1-0.9.el6_5, jakarta-commons-httpclient-javadoc-1:3.1-0.9.el6_5 +1
    • Red Hat Enterprise Linux Server (v. 6) jakarta-commons-httpclient-1:3.1-0.9.el6_5
    • Red Hat Enterprise Linux Server (v. 7) jakarta-commons-httpclient-1:3.1-16.el7_0
    • Red Hat Enterprise Linux Server Optional (v. 6) jakarta-commons-httpclient-1:3.1-0.9.el6_5, jakarta-commons-httpclient-demo-1:3.1-0.9.el6_5, jakarta-commons-httpclient-javadoc-1:3.1-0.9.el6_5 +1
    • Red Hat Enterprise Linux Server Optional (v. 7) jakarta-commons-httpclient-1:3.1-16.el7_0, jakarta-commons-httpclient-demo-1:3.1-16.el7_0, jakarta-commons-httpclient-javadoc-1:3.1-16.el7_0 +1
    • Red Hat Enterprise Linux Workstation (v. 6) jakarta-commons-httpclient-1:3.1-0.9.el6_5
    • Red Hat Enterprise Linux Workstation (v. 7) jakarta-commons-httpclient-1:3.1-16.el7_0
    • Red Hat Enterprise Linux Workstation Optional (v. 6) jakarta-commons-httpclient-1:3.1-0.9.el6_5, jakarta-commons-httpclient-demo-1:3.1-0.9.el6_5, jakarta-commons-httpclient-javadoc-1:3.1-0.9.el6_5 +1
    • Red Hat Enterprise Linux Workstation Optional (v. 7) jakarta-commons-httpclient-demo-1:3.1-16.el7_0, jakarta-commons-httpclient-javadoc-1:3.1-16.el7_0, jakarta-commons-httpclient-manual-1:3.1-16.el7_0
  • RHSA-2014:1162 Released 2014-09-04 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.3.0 security update
    • Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 5 Server httpclient-eap6-4.2.1-12.redhat_2.1.ep6.el5, httpcomponents-client-eap6-4.2.1-12.redhat_2.1.ep6.el5, httpcomponents-core-eap6-4.2.1-12.redhat_2.1.ep6.el5 +4
    • Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 6 Server httpclient-eap6-4.2.1-12.redhat_2.1.ep6.el6, httpcomponents-client-eap6-4.2.1-12.redhat_2.1.ep6.el6, httpcomponents-core-eap6-4.2.1-12.redhat_2.1.ep6.el6 +4
    • Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 7 Server httpclient-eap6-4.2.1-12.redhat_2.1.ep6.el7, httpcomponents-client-eap6-4.2.1-12.redhat_2.1.ep6.el7, httpcomponents-core-eap6-4.2.1-12.redhat_2.1.ep6.el7 +4
  • RHSA-2014:1163 Released 2014-09-04 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.3.0 security update
    • Red Hat JBoss Enterprise Application Platform 6.3
  • RHSA-2014:1146 Released 2014-09-03 · Red Hat rating Important
    httpcomponents-client security update
    • Red Hat Enterprise Linux Client Optional (v. 7) httpcomponents-client-4.2.5-5.el7_0, httpcomponents-client-javadoc-4.2.5-5.el7_0
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) httpcomponents-client-4.2.5-5.el7_0, httpcomponents-client-javadoc-4.2.5-5.el7_0
    • Red Hat Enterprise Linux Server (v. 7) httpcomponents-client-4.2.5-5.el7_0
    • Red Hat Enterprise Linux Server Optional (v. 7) httpcomponents-client-4.2.5-5.el7_0, httpcomponents-client-javadoc-4.2.5-5.el7_0
    • Red Hat Enterprise Linux Workstation (v. 7) httpcomponents-client-4.2.5-5.el7_0
    • Red Hat Enterprise Linux Workstation Optional (v. 7) httpcomponents-client-javadoc-4.2.5-5.el7_0
  • RHSA-2014:1082 Released 2014-08-20 · Red Hat rating Important
    thermostat1-httpcomponents-client security update
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 6) thermostat1-httpcomponents-client-4.2.5-3.4.el6.1, thermostat1-httpcomponents-client-javadoc-4.2.5-3.4.el6.1
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.4) thermostat1-httpcomponents-client-4.2.5-3.4.el6.1, thermostat1-httpcomponents-client-javadoc-4.2.5-3.4.el6.1
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 6) thermostat1-httpcomponents-client-4.2.5-3.4.el6.1, thermostat1-httpcomponents-client-javadoc-4.2.5-3.4.el6.1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Enterprise 1AffectedNo fix planned: Will not fix
Red Hat Enterprise Virtualization 3AffectedNo fix yet
Red Hat JBoss BRMS 5AffectedNo fix yet
Red Hat JBoss Data Grid 6AffectedNo fix yet
Red Hat JBoss Data Virtualization 6AffectedNo fix yet
Red Hat JBoss Enterprise Application Platform 4AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 5AffectedNo fix yet
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix yet
Red Hat JBoss Enterprise Web Server 1AffectedNo fix planned: Will not fix
Red Hat JBoss Fuse Service Works 6AffectedNo fix yet
Red Hat JBoss Operations Network 3AffectedNo fix yet
Red Hat JBoss Portal 5AffectedNo fix yet
Red Hat JBoss Portal 6AffectedNo fix yet
Red Hat JBoss SOA Platform 4AffectedNo fix planned: Will not fix
Red Hat OpenShift Enterprise 2AffectedNo fix yet
Red Hat Satellite 5AffectedNo fix planned: Will not fix
Red Hat Satellite 6AffectedNo fix yet
Red Hat Software CollectionsAffectedNo fix yet
Red Hat Storage 2AffectedNo fix planned: Will not fix
Red Hat Storage 3AffectedNo fix planned: Will not fix
Red Hat Virtualization 4AffectedNo fix yet
RHEV-M 3.5Fixed RHSA-2015:0158
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2014:1166
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2014:1166
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2014:1146, RHSA-2014:1166
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2014:1146, RHSA-2014:1166
Red Hat Enterprise Linux Desktop (v. 5 client)Fixed RHSA-2014:1166
Red Hat Enterprise Linux Desktop (v. 6)Fixed RHSA-2014:1166
Red Hat Enterprise Linux Desktop Optional (v. 6)Fixed RHSA-2014:1166
Red Hat Enterprise Linux Desktop Workstation (v. 5 client)Fixed RHSA-2014:1166
Red Hat Enterprise Linux HPC Node (v. 6)Fixed RHSA-2014:1166
Red Hat Enterprise Linux HPC Node Optional (v. 6)Fixed RHSA-2014:1166
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2014:1166
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2014:1146, RHSA-2014:1166
Red Hat Enterprise Linux Server Optional (v. 6)Fixed RHSA-2014:1166
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2014:1146, RHSA-2014:1166
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2014:1166
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2014:1146, RHSA-2014:1166
Red Hat Enterprise Linux Workstation Optional (v. 6)Fixed RHSA-2014:1166
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2014:1146, RHSA-2014:1166
Red Hat JBoss A-MQ 6.2Fixed RHSA-2015:1177
Red Hat JBoss BPMS 6.0Fixed RHSA-2015:0234
Red Hat JBoss BRMS 6.0Fixed RHSA-2015:0235
Red Hat JBoss Data Virtualization 6.0Fixed RHSA-2015:0765
Red Hat JBoss Data Virtualization 6.1Fixed RHSA-2015:0675
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ASFixed RHSA-2014:1321, RHSA-2014:1834
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ESFixed RHSA-2014:1321, RHSA-2014:1834
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 ServerFixed RHSA-2014:1321, RHSA-2014:1834
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 ServerFixed RHSA-2014:1321, RHSA-2014:1834
Red Hat JBoss Enterprise Application Platform 5.2Fixed RHSA-2014:1836
Red Hat JBoss Enterprise Application Platform 6.3Fixed RHSA-2014:2020
Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 5 ServerFixed RHSA-2014:1162, RHSA-2014:2019
Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 6 ServerFixed RHSA-2014:1162, RHSA-2014:2019
Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 7 ServerFixed RHSA-2014:1162, RHSA-2014:2019
Red Hat JBoss Fuse 6.2Fixed RHSA-2015:1176
Red Hat JBoss Fuse Service Works 6.0Fixed RHSA-2015:0720
Red Hat JBoss Operations Network 3.3Fixed RHSA-2014:1904
Red Hat JBoss Portal 6.2Fixed RHSA-2015:1009
Red Hat JBoss SOA Platform 5.3Fixed RHSA-2015:1888
Red Hat JBoss Web Framework Kit 2.7Fixed RHSA-2015:0125
Red Hat JBoss Web Platform 5 for RHEL 5 ServerFixed RHSA-2014:1320, RHSA-2014:1833
Red Hat JBoss Web Platform 5 for RHEL 6 ServerFixed RHSA-2014:1320, RHSA-2014:1833
Red Hat JBoss Web Platform 5.2Fixed RHSA-2014:1835
Red Hat OpenShift Container Platform 4.10Fixed RHSA-2022:0055
Red Hat OpenShift Enterprise Client 2.2Fixed RHSA-2016:1773
Red Hat OpenShift Enterprise Infrastructure 2.2Fixed RHSA-2016:1773
Red Hat OpenShift Enterprise JBoss EAP add-on 2.2Fixed RHSA-2016:1773
Red Hat OpenShift Enterprise Node 2.2Fixed RHSA-2016:1773
Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2014:1082
Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.4)Fixed RHSA-2014:1082
Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2014:1082
Not affected: 5 products
  • OpenShift Enterprise 1
  • Red Hat JBoss Web Platform 5 for RHEL 4 AS
  • Red Hat JBoss Web Platform 5 for RHEL 4 ES
  • Red Hat OpenShift Container Platform 4.10
  • Red Hat OpenShift Enterprise 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-3577
  2. 2026-10-03 Alias added: GHSA-cfh5-3ghh-wfjx

References

Exploit 2

Advisory 28

Other 26

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences