[AXIS2C-1619] CVE-2012-6107: SSL/TLS Hostname validation

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.7.0
• Component/s: transport/http
• Assignee: Unassigned
• Reporter: Seth Arnold
• Created: 22/Dec/12 02:23
• Updated: 07/Apr/20 17:35
• Resolved: 01/Sep/19 00:32

Description

I've looked through the source code and cannot find any peer hostname validation code. It appears to me that Axis2/c is vulnerable to the problems discussed in this paper: http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf

Have I overlooked the TLS / SSL peer name validation?

Thanks

Issue Links

• is cloned by: AXIS2C-1700 Enable SSL/TLS peer name validation by default