[
https://issues.apache.org/jira/browse/DOXIA-576?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Sylwester Lachiewicz reassigned DOXIA-576:
------------------------------------------
Assignee: Sylwester Lachiewicz
> Upgrade Http Components to 4.4.11 (core) and 4.5.8 (httpclient)
> ---------------------------------------------------------------
>
> Key: DOXIA-576
> URL: https://issues.apache.org/jira/browse/DOXIA-576
> Project: Maven Doxia
> Issue Type: Dependency upgrade
> Reporter: Sylwester Lachiewicz
> Assignee: Sylwester Lachiewicz
> Priority: Minor
> Fix For: 1.9
>
>
> The following vulnerabilities are fixed with an upgrade:
> [CVE-2011-1498|https://nvd.nist.gov/vuln/detail/CVE-2011-1498]
> Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with
> an authenticating proxy server, sends the Proxy-Authorization header to the
> origin server, which allows remote web servers to obtain sensitive
> information by logging this header. [Snyk.io
> details|https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-30644]
> [CVE-2012-6153|https://nvd.nist.gov/vuln/detail/CVE-2012-6153]
> http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before
> 4.2.3 does not properly verify that the server hostname matches a domain name
> in the subject's Common Name (CN) or subjectAltName field of the X.509
> certificate, which allows man-in-the-middle attackers to spoof SSL servers
> via a certificate with a subject that specifies a common name in a field that
> is not the CN field. NOTE: this issue exists because of an incomplete fix for
> CVE-2012-5783. [Snyk.io
> details|https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-30645]
> [CVE-2014-3577|https://nvd.nist.gov/vuln/detail/CVE-2014-3577]
> Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with
> an authenticating proxy server, sends the Proxy-Authorization header to the
> origin server, which allows remote web servers to obtain sensitive
> information by logging this header. [Snyk.io
> details|https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-30646]
> [CVE-2015-5262|https://nvd.nist.gov/vuln/detail/CVE-2015-5262]
> http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents
> HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting
> during an SSL handshake, which allows remote attackers to cause a denial of
> service (HTTPS call hang) via unspecified vectors. [Snyk.io
> details|https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-30647]
> HTTPCLIENT-1803
> Affected versions of the package are vulnerable to Directory Traversal,
> which may allow access to sensitive files and data on the server. [Snyk.io
> details|https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-31517]
> Discovered with [Snyk.io|https://snyk.io/] scan.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
