[AXIS2-5757] Version of httpclient bundled in axis2-1.7.1 is exposed to to the vulnerability CVE-2012-6153, CVE-2014-3577

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.4, 1.6.2, 1.6.3, 1.6.4, 1.7.0, 1.7.1
• Fix Version/s: 1.7.4
• Component/s: transports
• Labels: security
• Environment: Axis2 used as a Web Service Provider for an application
• Flags: Important
• Assignee: Andreas Veithen
• Reporter: Deepak
• Created: 13/Apr/16 10:57
• Updated: 13/Apr/17 20:32
• Resolved: 05/Jun/16 12:08

Description

Version of httpclient bundled in axis2-1.7.1 is exposed to to the vulnerability CVE-2012-6153, CVE-2014-3577

Hi

The version of httpclient (httpclient-4.2.1.jar) bundled with axis2-1.7.1 is susceptible to CVE-2012-6153, CVE-2014-3577

The Vulnerability says that the class "http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3" is vulnerability. (https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-6153)

What plans we have for Axis2 to address this Vulnerability. Will it be fixed in the upcoming 1.7.2 or 1.8 release or any other release. If yes, when would that be. Reason for this query is our application uses Axis2 and and hence exposed to this vulnerability.

Thanks,
Regds,
Deepak

Issue Links

• is duplicated by: AXIS2-5759 Upgrade HTTPCore and HTTPClient into latest versions