Apache HttpComponents HttpClient Vulnerability - Denial of Service Risk in SSL Handshake
Summary
DEBIAN-CVE-2015-5262: http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denia... Affects commons-httpclient versions < 3.1-12. Fixed in 3.1-12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HttpComponents HttpClient is a widely used library for making HTTP requests in Java applications. It provides a robust and flexible way to handle HTTP connections, including support for SSL/TLS. The library is essential for applications that require secure communication over the internet. However, a vulnerability has been identified that affects its handling of SSL connections, potentially leading to service disruptions.
Vulnerability Detail
The vulnerability arises from a flaw in the SSLConnectionSocketFactory.java file in Apache HttpComponents HttpClient versions prior to 4.3.6. This flaw causes the library to ignore the http.socket.timeout configuration during an SSL handshake. As a result, remote attackers can exploit this issue to create a denial of service condition, causing HTTPS calls to hang indefinitely. This can lead to significant disruptions in service, especially for applications relying on timely responses.
How To Fix
Minimum fixed version
3.1-12
This is the first release that contains the fix.
sudo apt-get install --only-upgrade commons-httpclientTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement a timeout mechanism in your application logic to handle potential hangs during SSL handshakes. This can be done by setting a timeout for your HTTP requests, ensuring that your application can recover from such situations without being indefinitely blocked.
Conclusion
The Apache HttpComponents HttpClient vulnerability poses a significant risk of denial of service due to improper handling of SSL handshakes. It is crucial for users of the affected versions to update to the patched version 4.3.6-1 or later to ensure the security and reliability of their applications. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for commons-httpclient →
FAQ
The vulnerability allows remote attackers to cause a denial of service by exploiting the SSL handshake process, leading to hanging HTTPS calls.
Versions of Apache HttpComponents HttpClient prior to 4.3.6 are affected by this vulnerability.
You can use Vulert, a tool that monitors open-source vulnerabilities, to check if your application is affected. Simply upload your manifest file like package-lock.json to the Vulert playground.
The primary impact is a denial of service, where applications may hang during SSL handshakes, leading to unresponsive services.
Yes, implementing a timeout mechanism in your application can help mitigate the risk temporarily until the package is updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for commons-httpclient.
