An update of the commons package has been released.

The remote MiracleLinux 3 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2013-107:01 advisory.

    The Hyper-Text Transfer Protocol (HTTP) is perhaps the most significant protocol used on the Internet     today. Web services, network-enabled appliances and the growth of network computing continue to expand the     role of the HTTP protocol beyond user-driven web browsers, and increase the number of applications that     may require HTTP support. Although the java.net package provides basic support for accessing resources via     HTTP, it doesn't provide the full flexibility or functionality needed by many applications. The Jakarta     Commons HTTP Client component seeks to fill this void by providing an efficient, up-to-date, and feature-     rich package implementing the client side of the most recent HTTP standards and recommendations. Designed     for extension while providing robust support for the base HTTP protocol, the HTTP Client component may be     of interest to anyone building HTTP-aware client applications such as web browsers, web service clients,     or systems that leverage or extend the HTTP protocol for distributed communication.
    Security issues fixed with this release:
     CVE-2012-5783     Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and     other products, does not verify that the server hostname matches a domain name in the subject's Common     Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to     spoof SSL servers via an arbitrary valid certificate.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2013-313:01 advisory.

    The Hyper-Text Transfer Protocol (HTTP) is perhaps the most significant protocol used on the Internet     today. Web services, network-enabled appliances and the growth of network computing continue to expand the     role of the HTTP protocol beyond user-driven web browsers, and increase the number of applications that     may require HTTP support. Although the java.net package provides basic support for accessing resources via     HTTP, it doesn't provide the full flexibility or functionality needed by many applications. The Jakarta     Commons HTTP Client component seeks to fill this void by providing an efficient, up-to-date, and feature-     rich package implementing the client side of the most recent HTTP standards and recommendations. Designed     for extension while providing robust support for the base HTTP protocol, the HTTP Client component may be     of interest to anyone building HTTP-aware client applications such as web browsers, web service clients,     or systems that leverage or extend the HTTP protocol for distributed communication.
    Security issues fixed with this release:
     CVE-2012-5783     Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and     other products, does not verify that the server hostname matches a domain name in the subject's Common     Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to     spoof SSL servers via an arbitrary valid certificate.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update fixes a security vulnerability that caused jakarta-commons-httpclient not to verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allowed man-in-the-middle attackers to spoof SSL servers via andaarbitrary valid certificate (CVE-2012-5783).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An updated jakarta-commons-httpclient package for JBoss Enterprise Application Platform 5.2.0 which fixes one security issue is now available for Red Hat Enterprise Linux 4, 5, and 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The Jakarta Commons HttpClient component can be used to build HTTP-aware client applications (such as web browsers and web service clients).

The Jakarta Commons HttpClient component did not verify that the server hostname matched the domain name in the subject's Common Name (CN) or subjectAltName field in X.509 certificates. This could allow a man-in-the-middle attacker to spoof an SSL server if they had a certificate that was valid for any domain name. (CVE-2012-5783)

Warning: Before applying this update, back up your existing JBoss Enterprise Application Platform installation (including all applications and configuration files).

All users of JBoss Enterprise Application Platform 5.2.0 on Red Hat Enterprise Linux 4, 5, and 6 are advised to upgrade to this updated package. The JBoss server process must be restarted for the update to take effect.

The following issue has been fixed :

  - SSL certificate hostname verification was not done and     is fixed by this update. (CVE-2012-5783)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-0270 advisory.

    [1:3.1-0.7]
    - Add missing connection hostname check against X.509 certificate name
    - Resolves: CVE-2012-5783

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Jakarta Commons HttpClient component did not verify that the server hostname matched the domain name in the subject's Common Name (CN) or subjectAltName field in X.509 certificates. This could allow a man-in-the-middle attacker to spoof an SSL server if they had a certificate that was valid for any domain name. (CVE-2012-5783)

jakarta-commons-httpclient was updated to enhance the fix of bnc#803332 / CVE-2012-5783

  - also check for subjectAltNames in the certificate.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
140702	Photon OS 3.0: Commons PHSA-2020-3.0-0141	Nessus	PhotonOS Local Security Checks	2020/9/21	2025/8/22	medium
289662	MiracleLinux 3 : jakarta-commons-httpclient-3.0-7jpp.2 (AXSA:2013-107:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	low
289888	MiracleLinux 4 : jakarta-commons-httpclient-3.1-0.7.AXS4 (AXSA:2013-313:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	low
64404	Fedora 18 : jakarta-commons-httpclient-3.1-12.fc18 (2013-1203)	Nessus	Fedora Local Security Checks	2013/2/4	2021/1/11	medium
65677	RHEL 5 / 6 : jakarta-commons-httpclient (RHSA-2013:0680)	Nessus	Red Hat Local Security Checks	2013/3/26	2021/1/14	medium
65795	SuSE 11.2 Security Update : jakarta (SAT Patch Number 7574)	Nessus	SuSE Local Security Checks	2013/4/4	2021/1/19	medium
68731	Oracle Linux 5 / 6 : jakarta-commons-httpclient (ELSA-2013-0270)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/22	low
69728	Amazon Linux AMI : jakarta-commons-httpclient (ALAS-2013-169)	Nessus	Amazon Linux Local Security Checks	2013/9/4	2018/4/18	medium
74960	openSUSE Security Update : jakarta-commons-httpclient (openSUSE-SU-2013:0622-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	medium

検出

プラグインの検索

medium

low

low

medium

medium

medium

low

medium

medium