Uploaded image for project: 'HttpComponents HttpClient'
  1. HttpComponents HttpClient
  2. HTTPCLIENT-1265

Insecure certificate validation CVE-2012-5783

Attach filesAttach ScreenshotVotersWatch issueWatchersCreate sub-taskLinkCloneUpdate Comment AuthorReplace String in CommentUpdate Comment VisibilityDelete Comments
    XMLWordPrintableJSON

Details

    • Bug
    • Status: Closed
    • Major
    • Resolution: Implemented
    • 3.1 (end of life)
    • None
    • HttpClient (classic)
    • None
    • All

    Description

      See.
      http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf

      Using JSSE you must manually validate server name you're connecting to matches one of the names provided by the certificate. So you can detect a man-in-the-middle type attack with a valid certificado for other site.

      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5783

      Attachments

        Activity

          This comment will be Viewable by All Users Viewable by All Users
          Cancel

          People

            Unassigned Unassigned
            infjaf Alberto Fernández
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Slack

                Issue deployment