Skip to content
Fencer Intel
medium 5.8

CVE-2014-3577 json

Improper Verification of Cryptographic Signature in org.apache.httpcomponents:httpclient

published 2014-08-21 12 y ago modified 2026-06-17 4 mo ago also GHSA-cfh5-3ghh-wfjx , EUVD-2018-0575

cvss
5.8
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
9.2%
EPSS 9.2% chance of exploitation in 30 days, percentile 95%
public exploits
0
none known

Summary

org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field.

Patch / fix

  • maven org.apache.httpcomponents:httpclient 4.3.5
  • commons-httpclient Debian 14, Debian 13, Debian 12 3.1-11
  • httpcomponents-client Debian 14, Debian 13, Debian 12 4.3.5-1

debian advisories DEBIAN-CVE-2014-3577

  • commons-httpclient Ubuntu 14.04 LTS 3.1-10.2ubuntu0.14.04.1
  • httpcomponents-client Ubuntu 14.04 LTS 4.3.3-1ubuntu0.1

ubuntu advisories UBUNTU-CVE-2014-3577

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • cri-o openshift 4.10 1.23.0-92.rhaos4.10.gitdaab4d1.el7
  • cri-o openshift 4.10 1.23.1-9.rhaos4.10.gitbdffb9a.el8
  • jenkins openshift 4.10 2.319.2.1643288987-1.el8
  • openshift openshift 4.10 4.10.0-202202250816.p0.ge419edf.assembly.stream.el7
  • openshift openshift 4.10 4.10.0-202202250816.p0.ge419edf.assembly.stream.el8
  • coreos-installer openshift 4.10 0.12.0-1.rhaos4.10.el8
  • jenkins-2-plugins openshift 4.10 4.10.1643404185-1.el8
  • openshift-clients openshift 4.10 4.10.0-202202160023.p0.gf93da17.assembly.stream.el7

red hat advisories RHSA-2022:0055RHSA-2016:1773RHSA-2015:0158RHSA-2014:2019RHSA-2014:1834RHSA-2014:1833

  • apache-commons-httpclient SLE Module for Basesystem 15 SP2 3.1-11.3.2
  • apache-commons-httpclient SLES for SAP 15, SLES 15-LTSS, SLE Module for Basesystem 15 SP1 +2 more 3.1-4.3.2
  • apache-commons-httpclient SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES for SAP 12 SP3 +14 more 3.1-6.3.1

suse advisories SUSE-SU-2020:3152-1SUSE-SU-2020:3151-1SUSE-SU-2020:3149-1

  • apache-commons-httpclient openSUSE Tumbleweed 3.1-13.4
  • apache-commons-httpclient openSUSE Leap 15.2 3.1-lp152.6.3.1
  • apache-commons-httpclient openSUSE Leap 15.1 3.1-lp151.4.3.1

opensuse advisories openSUSE-SU-2024:10621-1openSUSE-SU-2020:1875-1openSUSE-SU-2020:1873-1

  • jenkins Arch Linux 2.315-1

arch linux advisories AVG-2448

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2014-3577 updated cvss 4.8

CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix

  • Red Hat OpenShift Enterprise 1 jakarta-commons-httpclient
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Virtualization 3 rhevm-dependencies, redhat-support-plugin-rhev
    affected: no fix available
  • Red Hat JBoss BRMS 5 cxf, httpclient, jakarta-commons-httpclient, modeshape-client modeshape-client
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat JBoss Data Grid 6 cxf, httpclient
    affected: no fix available
  • Red Hat JBoss Data Virtualization 6 cxf, modeshape-client modeshape-client
    affected: no fix available “Fix deferred”
  • Red Hat JBoss Enterprise Application Platform 4 jakarta-commons-httpclient
    affected: no fix planned “Will not fix”
  • Red Hat JBoss Enterprise Application Platform 5 cxf
    affected: no fix available
  • Red Hat JBoss Enterprise Application Platform 6 cxf, jakarta-commons-httpclient
    affected: no fix available “Fix deferred”
show 10 more
  • Red Hat JBoss Enterprise Web Server 1 jakarta-commons-httpclient
    affected: no fix planned “Will not fix”
  • Red Hat JBoss Fuse Service Works 6 cxf Red Hat JBoss Operations Network 3 cxf Red Hat JBoss Portal 5 httpclient, jakarta-commons-httpclient Red Hat JBoss Portal 6 cxf
    affected: no fix available
  • Red Hat JBoss SOA Platform 4 jakarta-commons-httpclient
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Enterprise 2 httpclient
    affected: no fix available
  • Red Hat Satellite 5 jakarta-commons-httpclient
    affected: no fix planned “Will not fix”
  • Red Hat Satellite 6 httpcomponents-client Red Hat Software Collections maven30-httpcomponents-client, maven30-jakarta-commons-httpclient, maven30-httpcomponents-client-javadoc, maven30-jakarta-commons-httpclient-demo, maven30-jakarta-commons-httpclient-manual, maven30-jakarta-commons-httpclient-javadoc
    affected: no fix available
  • Red Hat Storage 2 rhevm-dependencies Red Hat Storage 3 rhevm-dependencies
    affected: no fix planned “Will not fix”
  • Red Hat Virtualization 4 ovirt-engine-sdk-java, ovirt-engine-sdk-java-javadoc
    affected: no fix available
  • Red Hat Enterprise Linux (v. 5 server) jakarta-commons-httpclient 3.0-7jpp.4.el5_10, jakarta-commons-httpclient-demo 3.0-7jpp.4.el5_10, jakarta-commons-httpclient-manual 3.0-7jpp.4.el5_10, jakarta-commons-httpclient-javadoc 3.0-7jpp.4.el5_10 Red Hat Enterprise Linux Client (v. 7) jakarta-commons-httpclient 3.1-16.el7_0 Red Hat Enterprise Linux Client Optional (v. 7) httpcomponents-client 4.2.5-5.el7_0, httpcomponents-client-javadoc 4.2.5-5.el7_0, jakarta-commons-httpclient-demo 3.1-16.el7_0, jakarta-commons-httpclient-manual 3.1-16.el7_0, jakarta-commons-httpclient-javadoc 3.1-16.el7_0 Red Hat Enterprise Linux ComputeNode Optional (v. 7) httpcomponents-client 4.2.5-5.el7_0, jakarta-commons-httpclient 3.1-16.el7_0, httpcomponents-client-javadoc 4.2.5-5.el7_0, jakarta-commons-httpclient-demo 3.1-16.el7_0, jakarta-commons-httpclient-manual 3.1-16.el7_0, jakarta-commons-httpclient-javadoc 3.1-16.el7_0 Red Hat Enterprise Linux Desktop (v. 5 client) jakarta-commons-httpclient 3.0-7jpp.4.el5_10 Red Hat Enterprise Linux Desktop (v. 6) jakarta-commons-httpclient 3.1-0.9.el6_5
    +12 more products
    Red Hat Enterprise Linux Desktop Optional (v. 6) jakarta-commons-httpclient 3.1-0.9.el6_5, jakarta-commons-httpclient-demo 3.1-0.9.el6_5, jakarta-commons-httpclient-manual 3.1-0.9.el6_5, jakarta-commons-httpclient-javadoc 3.1-0.9.el6_5 Red Hat Enterprise Linux Desktop Workstation (v. 5 client) jakarta-commons-httpclient 3.0-7jpp.4.el5_10, jakarta-commons-httpclient-demo 3.0-7jpp.4.el5_10, jakarta-commons-httpclient-manual 3.0-7jpp.4.el5_10, jakarta-commons-httpclient-javadoc 3.0-7jpp.4.el5_10 Red Hat Enterprise Linux HPC Node (v. 6) jakarta-commons-httpclient 3.1-0.9.el6_5 Red Hat Enterprise Linux HPC Node Optional (v. 6) jakarta-commons-httpclient 3.1-0.9.el6_5, jakarta-commons-httpclient-demo 3.1-0.9.el6_5, jakarta-commons-httpclient-manual 3.1-0.9.el6_5, jakarta-commons-httpclient-javadoc 3.1-0.9.el6_5 Red Hat Enterprise Linux Server (v. 6) jakarta-commons-httpclient 3.1-0.9.el6_5 Red Hat Enterprise Linux Server (v. 7) httpcomponents-client 4.2.5-5.el7_0, jakarta-commons-httpclient 3.1-16.el7_0 Red Hat Enterprise Linux Server Optional (v. 6) jakarta-commons-httpclient 3.1-0.9.el6_5, jakarta-commons-httpclient-demo 3.1-0.9.el6_5, jakarta-commons-httpclient-manual 3.1-0.9.el6_5, jakarta-commons-httpclient-javadoc 3.1-0.9.el6_5 Red Hat Enterprise Linux Server Optional (v. 7) httpcomponents-client 4.2.5-5.el7_0, jakarta-commons-httpclient 3.1-16.el7_0, httpcomponents-client-javadoc 4.2.5-5.el7_0, jakarta-commons-httpclient-demo 3.1-16.el7_0, jakarta-commons-httpclient-manual 3.1-16.el7_0, jakarta-commons-httpclient-javadoc 3.1-16.el7_0 Red Hat Enterprise Linux Workstation (v. 6) jakarta-commons-httpclient 3.1-0.9.el6_5 Red Hat Enterprise Linux Workstation (v. 7) httpcomponents-client 4.2.5-5.el7_0, jakarta-commons-httpclient 3.1-16.el7_0 Red Hat Enterprise Linux Workstation Optional (v. 6) jakarta-commons-httpclient 3.1-0.9.el6_5, jakarta-commons-httpclient-demo 3.1-0.9.el6_5, jakarta-commons-httpclient-manual 3.1-0.9.el6_5, jakarta-commons-httpclient-javadoc 3.1-0.9.el6_5 Red Hat Enterprise Linux Workstation Optional (v. 7) httpcomponents-client-javadoc 4.2.5-5.el7_0, jakarta-commons-httpclient-demo 3.1-16.el7_0, jakarta-commons-httpclient-manual 3.1-16.el7_0, jakarta-commons-httpclient-javadoc 3.1-16.el7_0
    fixed: vendor fix RHSA-2014:1166
  • Red Hat JBoss A-MQ 6.2
    fixed: vendor fix RHSA-2015:1177

31 more fixed, 5 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

9.19% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • packetstormsecurity.com http://packetstormsecurity.com/files/127913/Apache-HttpComponents-Man-In-The-Middle.html referenced PoC, tagged "exploit" by a source, unverified
  • seclists.org http://seclists.org/fulldisclosure/2014/Aug/48 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N

Affected packages

ecosystem package affected fixed in
maven org.apache.httpcomponents:httpclient
<4.3.5
4.3.5

Classification

Weakness
  • CWE-347 Improper Verification of Cryptographic Signature

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.