What is GHSA-pqwh-44jj-p5rm?

GHSA-pqwh-44jj-p5rm is a security advisory published by GitHub Security Advisories with Critical severity. Hostname verification in Apache HttpClient 4.3 was disabled by default

Which CVE IDs does GHSA-pqwh-44jj-p5rm cover?

GHSA-pqwh-44jj-p5rm covers the following CVE IDs: CVE-2013-4366. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-pqwh-44jj-p5rm?

GHSA-pqwh-44jj-p5rm has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-pqwh-44jj-p5rm?

GHSA-pqwh-44jj-p5rm affects 1 product, including: maven/org.apache.httpcomponents:httpclient:\u003e= 4.3, \u003c 4.3.1.

GHSA-pqwh-44jj-p5rmCriticalCVSS 9.8

Hostname verification in Apache HttpClient 4.3 was disabled by default

Vendor

GitHub Security Advisories

Published

May 13, 2022

Last Modified

March 5, 2024

🔗 CVE IDs covered (1)

CVE-2013-4366 →

📋 Description

http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509HostnameVerifier is not null, which allows attackers to have unspecified impact via vectors involving hostname verification.

🎯 Affected products1

maven/org.apache.httpcomponents:httpclient:>= 4.3, < 4.3.1

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2013-4366
http://svn.apache.org/r1528614
http://www.apache.org/dist/httpcomponents/httpclient/RELEASE_NOTES-4.3.x.txt
https://github.com/apache/httpcomponents-client/commit/08140864e3e4c0994e094c4cf0507932baf6a66
https://github.com/advisories/GHSA-pqwh-44jj-p5rm