Denial of Service in Apache HttpComponents HttpClient
Summary
CVE-2015-5262: http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denia... Affects commons-httpclient versions < 3.1-12. Fixed in 3.1-12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HttpComponents HttpClient is a library for making HTTP requests in Java. It provides a set of classes and methods to interact with HTTP servers and handle various aspects of the HTTP protocol. This vulnerability affects versions before 4.3.6 of the library.
Vulnerability Detail
The vulnerability, identified as CVE-2015-5262, exists in the SSLConnectionSocketFactory class of Apache HttpComponents HttpClient. During an SSL handshake, the library ignores the http.socket.timeout configuration setting. This oversight allows remote attackers to cause a denial of service by initiating an HTTPS call that hangs indefinitely. The exact vectors for exploitation are unspecified.
How To Fix
Minimum fixed version
3.1-12
This is the first release that contains the fix.
sudo apt-get install --only-upgrade commons-httpclientTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
In conclusion, the Apache HttpComponents HttpClient library before version 4.3.6 is vulnerable to a denial of service attack. It is recommended to upgrade to the latest version of the httpcomponents-client package to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for commons-httpclient →
FAQ
Apache HttpComponents HttpClient is a Java library for making HTTP requests.
The vulnerability allows remote attackers to cause a denial of service by hanging HTTPS calls.
Versions before 4.3.6-1 of the httpcomponents-client package are affected.
No workaround has been provided for this vulnerability.
To fix this vulnerability, upgrade to version 4.3.6-1 or later of the httpcomponents-client package.
References
Related vulnerabilities
Recent vulnerabilities recorded for commons-httpclient.
