NVD Vulnerability Detail

CVE-2013-7398

Summary	main/java/com/ning/http/client/AsyncHttpClientConfig.java in Async Http Client (aka AHC or async-http-client) before 1.9.0 does not require a hostname match during verification of X.509 certificates, which allows man-in-the-middle attackers to spoof HTTPS servers via an arbitrary valid certificate.
Publication Date	June 25, 2015, 1:59 a.m.
Registration Date	Jan. 26, 2021, 3:49 p.m.
Last Update	Nov. 21, 2024, 11 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:async-http-client_project:async-http-client::beta24::::::*			1.9.0

Configuration2		or higher	or less	more than	less than
cpe:2.3:a:redhat:jboss_fuse::::::::			6.1.0

Related information, measures and tools

No	URL	タグ
1	http://openwall.com/lists/oss-security/2014/08/26/1
2	http://openwall.com/lists/oss-security/2014/08/26/1
3	http://rhn.redhat.com/errata/RHSA-2015-0850.html
4	http://rhn.redhat.com/errata/RHSA-2015-0850.html
5	http://rhn.redhat.com/errata/RHSA-2015-0851.html
6	http://rhn.redhat.com/errata/RHSA-2015-0851.html
7	http://rhn.redhat.com/errata/RHSA-2015-1176.html
8	http://rhn.redhat.com/errata/RHSA-2015-1176.html
9	http://rhn.redhat.com/errata/RHSA-2015-1551.html
10	http://rhn.redhat.com/errata/RHSA-2015-1551.html
11	http://www.securityfocus.com/bid/69317
12	http://www.securityfocus.com/bid/69317
13	https://github.com/AsyncHttpClient/async-http-client/issues/197	Vendor Advisory
14	https://github.com/AsyncHttpClient/async-http-client/issues/197	Vendor Advisory
15	https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E
16	https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E
17	https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E
18	https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E
19	https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-06-20
20	https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-06-20

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-345	データの信頼性についての不十分な検証	https://cwe.mitre.org/data/definitions/345.html

JVN Vulnerability Information

Async Http Client の main/java/com/ning/http/client/AsyncHttpClientConfig.java における HTTPS サーバになりすまされる脆弱性

Title	Async Http Client の main/java/com/ning/http/client/AsyncHttpClientConfig.java における HTTPS サーバになりすまされる脆弱性
Summary	Async Http Client (別名 AHC または async-http-client) の main/java/com/ning/http/client/AsyncHttpClientConfig.java は、X.509 証明書の検証時にホスト名の一致を要求しないため、HTTPS サーバになりすまされる脆弱性が存在します。補足情報 : CWE による脆弱性タイプは、CWE-345: Insufficient Verification of Data Authenticity (データの信頼性についての不十分な検証) と識別されています。 http://cwe.mitre.org/data/definitions/345.html
Possible impacts	中間者攻撃 (man-in-the-middle attack) により、任意の有効な証明書を介して、HTTPS サーバになりすまされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	July 30, 2013, midnight
Registration Date	June 26, 2015, 2:05 p.m.
Last Update	Aug. 11, 2015, 4:33 p.m.

Affected System

Async Http Client project

Async Http Client 1.9.0 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2013-7398	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7398
National Vulnerability Database (NVD)
2	CVE-2013-7398	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-7398

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-Other	https://www.ipa.go.jp/security/vuln/CWE.html#CWEOther

ベンダー情報

No	Name	URL
GitHub
1	SSL host name verification disabled by default #197	https://github.com/AsyncHttpClient/async-http-client/issues/197
Red Hat Security Advisory
2	RHSA-2015:0850	https://rhn.redhat.com/errata/RHSA-2015-0850.html
3	RHSA-2015:0851	https://rhn.redhat.com/errata/RHSA-2015-0851.html
4	RHSA-2015:1176	https://rhn.redhat.com/errata/RHSA-2015-1176.html

Change Log

No	Changed Details	Date of change
0	[2015年06月26日] 掲載 [2015年07月30日] ベンダ情報：レッドハット (RHSA-2015:1176) を追加 [2015年08月11日] ベンダ情報：レッドハット (RHSA-2015:0850) を追加ベンダ情報：レッドハット (RHSA-2015:0851) を追加	Feb. 17, 2018, 10:37 a.m.