Description

http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509HostnameVerifier is not null, which allows attackers to have unspecified impact via vectors involving hostname verification.

Remediation

References

http://svn.apache.org/r1528614

http://www.apache.org/dist/httpcomponents/httpclient/RELEASE_NOTES-4.3.x.txt

Related Vulnerabilities

CVE-2023-44794 Vulnerability in maven package cn.dev33:sa-token-core

CVE-2021-41182 Vulnerability in maven package org.webjars.npm:jquery-ui

CVE-2023-25158 Vulnerability in maven package org.geotools:gt-main

CVE-2023-26474 Vulnerability in maven package org.xwiki.platform:xwiki-platform-legacy-oldcore

CVE-2021-4307 Vulnerability in npm package baobab

Severity

Critical

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Issue Tracking Patch Release Notes Vendor Advisory CWE-20