Ubuntu 12.04 LTS USN-2769-1 Moderate: Commons HttpClient Man In The Middle

ubuntu

October 14, 2015

Several security issues were fixed in commons-httpclient.

Summary

Several security issues were fixed in commons-httpclient.

Software Description:

- commons-httpclient: A Java(TM) library for creating HTTP clients

Details:

It was discovered that Apache Commons HttpClient did not properly verify the

Common Name or subjectAltName fields of X.509 certificates. An attacker could

exploit this to perform a man in the middle attack to view sensitive

information or alter encrypted communications. This issue only affected Ubuntu

12.04 LTS. (CVE-2012-5783)

Florian Weimer discovered the fix for CVE-2012-5783 was incomplete for Apache

Commons HttpClient. An attacker could exploit this to perform a man in the

middle attack to view sensitive information or alter encrypted communications.

This issue only affected Ubuntu 12.04 LTS. (CVE-2012-6153)

Subodh Iyengar and Will Shackleton discovered the fix for CVE-2012-5783 was

incomplete for Apache Commons HttpClient. An attacker could exploit this to

perform a man in the middle attack to view sensitive informati...

Read the Full Advisory

Topics Covered

security advisory moderate denial of service ubuntu man in the middle commons httpclient

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 15.04:
  libcommons-httpclient-java      3.1-10.2ubuntu0.15.04.1

Ubuntu 14.04 LTS:
  libcommons-httpclient-java      3.1-10.2ubuntu0.14.04.1

Ubuntu 12.04 LTS:
  libcommons-httpclient-java      3.1-10ubuntu0.1

In general, a standard system update will make all the necessary changes.