[
https://issues.apache.org/jira/browse/HTTPCLIENT-1256?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15009359#comment-15009359
]
Volker Kleinschmidt commented on HTTPCLIENT-1256:
-------------------------------------------------
Unfortunately, version 4.2 wasn't really safe either, see
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3577 and
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6153
> HttpClient permits man in the middle attacks when using HTTPS
> -------------------------------------------------------------
>
> Key: HTTPCLIENT-1256
> URL: https://issues.apache.org/jira/browse/HTTPCLIENT-1256
> Project: HttpComponents HttpClient
> Issue Type: Bug
> Components: HttpClient
> Affects Versions: 3.1 (end of life)
> Reporter: Robert Elliot
> Priority: Critical
>
> As documented here:http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf HttpClient
> 3.1 does not use JSSE correctly - specifically, a request over HTTPS does not
> validate that the returned certificate is actually for the domain originally
> requested. This means a man in the middle attack via DNS poisoning will work.
> I have proven this locally by setting a /etc/hosts entry for www.google.com
> to the IP address of github.com. When I then run the following code:
> HttpClient client = new HttpClient();
> GetMethod get = new GetMethod("https://www.google.com";);
> client.executeMethod(get);
> System.out.println(get.getResponseBodyAsString());
> I am returned the contents of the github.com page. I should have had an
> exception warning me that the certificate was not valid for www.google.com.
> Whilst I appreciate that 3.x is not under development, given the large number
> of applications and libraries (such as Axis 1 & 2) that depend on version 3
> it would seem responsible to fix this vulnerability.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
