Upstream information
Description
Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.NVD CVSS v2 Base Score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)
Novell/SUSE information
Novell Bugzilla entry: 803332, 803333 SUSE Security Advisories:- openSUSE-SU-2013:0354-1, published Wed, 27 Feb 2013 18:04:34 +0100 (CET)
- openSUSE-SU-2013:0622-1, published Thu, 4 Apr 2013 17:05:52 +0200 (CEST)
- openSUSE-SU-2013:0623-1, published Thu, 4 Apr 2013 17:06:08 +0200 (CEST)
- openSUSE-SU-2013:0638-1, published Mon, 8 Apr 2013 16:04:29 +0200 (CEST)
List of released packages
| Product(s) | Fixed package version(s) | References |
|---|---|---|
| SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Server 11 SP2 for VMware |
| Builds SAT Patch Nr: 7574 |
| SUSE Manager 1.2 for SLE 11 SP1 |
| Builds SAT Patch Nr: 7572 |