CVE-2013-7397: Insufficient Verification of Data Authenticity
(updated )
Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, which allows man-in-the-middle attackers to spoof HTTPS servers by presenting an arbitrary certificate during use of a typical AHC configuration, as demonstrated by a configuration that does not send client certificates.
References
- openwall.com/lists/oss-security/2014/08/26/1
- rhn.redhat.com/errata/RHSA-2015-0850.html
- rhn.redhat.com/errata/RHSA-2015-0851.html
- rhn.redhat.com/errata/RHSA-2015-1176.html
- rhn.redhat.com/errata/RHSA-2015-1551.html
- github.com/AsyncHttpClient/async-http-client/issues/352
- github.com/advisories/GHSA-8h53-fjgg-g42g
- lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3E
- lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E
- nvd.nist.gov/vuln/detail/CVE-2013-7397
- wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-06-20
Code Behaviors & Features
Detect and mitigate CVE-2013-7397 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →