CVE-2013-7398

2015-06-2416:59:01

CWE-345

mitre

web.nvd.nist.gov

async http client

ahc

man-in-the-middle

spoofed https servers

cve-2013-7398

nvd

x.509 certificates

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

8.9

Confidence

High

EPSS

0.003

Percentile

69.7%

JSON

main/java/com/ning/http/client/AsyncHttpClientConfig.java in Async Http Client (aka AHC or async-http-client) before 1.9.0 does not require a hostname match during verification of X.509 certificates, which allows man-in-the-middle attackers to spoof HTTPS servers via an arbitrary valid certificate.

Affected configurations

Nvd

Node

async-http-client_projectasync-http-clientRange≤1.9.0beta24

Node

redhatjboss_fuseRange≤6.1.0

VendorProductVersionCPE
async-http-client_projectasync-http-client*cpe:2.3:a:async-http-client_project:async-http-client:*:beta24:*:*:*:*:*:*
redhatjboss_fuse*cpe:2.3:a:redhat:jboss_fuse:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
async-http-client_project	async-http-client	*	cpe:2.3:a:async-http-client_project:async-http-client::beta24::::::*
redhat	jboss_fuse	*	cpe:2.3:a:redhat:jboss_fuse::::::::