GHSA-8h53-fjgg-g42g

Source

https://github.com/advisories/GHSA-8h53-fjgg-g42g

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-8h53-fjgg-g42g/GHSA-8h53-fjgg-g42g.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-8h53-fjgg-g42g

Aliases

CVE-2013-7397

Published

2022-05-13T01:12:18Z

Modified

2024-11-30T05:49:56.055915Z

Summary

Insufficient Verification of Data Authenticity in Async Http Client

Details

Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, which allows man-in-the-middle attackers to spoof HTTPS servers by presenting an arbitrary certificate during use of a typical AHC configuration, as demonstrated by a configuration that does not send client certificates.

Database specific

{
    "nvd_published_at": "2015-06-24T16:59:00Z",
    "cwe_ids": [
        "CWE-345"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-07T23:14:07Z"
}

References

Affected packages

Maven / com.ning:async-http-client

Package

Name: com.ning:async-http-client; View open source insights on deps.dev
Purl: pkg:maven/com.ning/async-http-client

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.9.0

Affected versions

1.*

1.0.0

1.1.0

1.2.0

1.3.0

1.3.1

1.3.2

1.3.3

1.3.4

1.4.0

1.4.1

1.5.0

1.6.0

1.6.1

1.6.2

1.6.3

1.6.4

1.6.5

1.7.0-RC1

1.7.0

1.7.1

1.7.2

1.7.3

1.7.4

1.7.5

1.7.6

1.7.7

1.7.8

1.7.9

1.7.10

1.7.11

1.7.12

1.7.13

1.7.14

1.7.15

1.7.16

1.7.17

1.7.18

1.7.19

1.7.20

1.7.21

1.7.22

1.7.23

1.7.24

1.7.24-jenkins-1

1.8.0

1.8.1

1.8.2

1.8.3

1.8.4

1.8.5

1.8.6

1.8.7

1.8.8

1.8.9

1.8.10

1.8.11

1.8.12

1.8.13

1.8.14

1.8.15

1.8.16

1.8.17

1.9.0-BETA1

1.9.0-BETA2

1.9.0-BETA3

1.9.0-BETA4

1.9.0-BETA5

1.9.0-BETA6

1.9.0-BETA7

1.9.0-BETA8

1.9.0-BETA9

1.9.0-BETA10

1.9.0-BETA11

1.9.0-BETA12

1.9.0-BETA13

1.9.0-BETA14

1.9.0-BETA15

1.9.0-BETA16

1.9.0-BETA17

1.9.0-BETA18

1.9.0-BETA19

1.9.0-BETA20

1.9.0-BETA21

1.9.0-BETA22

1.9.0-BETA23

1.9.0-BETA24