drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Mehrere Probleme in commons-httpclient
Name: |
Mehrere Probleme in commons-httpclient |
|
ID: |
USN-2769-1 |
|
Distribution: |
Ubuntu |
|
Plattformen: |
Ubuntu 12.04 LTS, Ubuntu 14.04 LTS, Ubuntu 15.04 |
|
Datum: |
Mi, 14. Oktober 2015, 18:45 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6153
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5783
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3577
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5262 |
|
Applikationen: |
commons-httpclient |
|
Originalnachricht |
--===============3497198943839608913== Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="jRHKVT23PllUwdXP" Content-Disposition: inline
--jRHKVT23PllUwdXP Content-Type: text/plain; charset=us-ascii Content-Disposition: inline
========================================================================== Ubuntu Security Notice USN-2769-1 October 14, 2015
commons-httpclient vulnerabilities ==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 15.04 - Ubuntu 14.04 LTS - Ubuntu 12.04 LTS
Summary:
Several security issues were fixed in commons-httpclient.
Software Description: - commons-httpclient: A Java(TM) library for creating HTTP clients
Details:
It was discovered that Apache Commons HttpClient did not properly verify the Common Name or subjectAltName fields of X.509 certificates. An attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications. This issue only affected Ubuntu 12.04 LTS. (CVE-2012-5783)
Florian Weimer discovered the fix for CVE-2012-5783 was incomplete for Apache Commons HttpClient. An attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications. This issue only affected Ubuntu 12.04 LTS. (CVE-2012-6153)
Subodh Iyengar and Will Shackleton discovered the fix for CVE-2012-5783 was incomplete for Apache Commons HttpClient. An attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications. (CVE-2014-3577)
It was discovered that Apache Commons HttpClient did not properly handle read timeouts during HTTPS handshakes. A remote attacker could trigger this flaw to cause a denial of service. (CVE-2015-5262)
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 15.04: libcommons-httpclient-java 3.1-10.2ubuntu0.15.04.1
Ubuntu 14.04 LTS: libcommons-httpclient-java 3.1-10.2ubuntu0.14.04.1
Ubuntu 12.04 LTS: libcommons-httpclient-java 3.1-10ubuntu0.1
In general, a standard system update will make all the necessary changes.
References: http://www.ubuntu.com/usn/usn-2769-1 CVE-2012-5783, CVE-2012-6153, CVE-2014-3577, CVE-2015-5262
Package Information: https://launchpad.net/ubuntu/+source/commons-httpclient/3.1-10.2ubuntu0.15.04.1 https://launchpad.net/ubuntu/+source/commons-httpclient/3.1-10.2ubuntu0.14.04.1 https://launchpad.net/ubuntu/+source/commons-httpclient/3.1-10ubuntu0.1
--jRHKVT23PllUwdXP Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQIcBAEBCgAGBQJWHnacAAoJENaSAD2qAscKmsYQALwweoz8IMYCviK3mX2By+8q aCjQnulxWwMyhD7Mjn5r9jFObu+2lQIzqhSqni6c/dQsOYNmamFfwBvAQVJ+ZC2U HLIJ3s/V7mHi9wHGzrQpw//ccRN9SKqEqsXyFF3A4ktdQiglYZRvD9ZIXzgHlnVR MHaGrBUjYefdR6A0KYBcjjwqpa+w/l45xTWQ4PsynxRnBMSsqyCaB74D8wpljm6I rusyL2r5kf6nnWMFDUxliCYccpabeofHP1Rk5bmSAVymyHWaX866275r76KRo7S4 Mm7szPtFy9E6ljZoTtgfxpCn9JKxER8F4r4oA8Ze7T4xbYVUNFzbVxOUUTIHRfAu g26aynoGm4DKzGNyGwN7hBlqY4dDbVh3o/LJ4JYvTSd7wCkgXh6cuHX5Tno5ONiV FkdQ7mypHUapYwwhrKcrGzKhUwwJJjrdOuw/hr6voDDLCCP9Ei1rFtLm74hfH/ea 2uMKiekDjdQcm0vvImCqvoFN7qEQ5Ux2bmC8DE137C0KnkVns74RCgG8KcasiySS V66rllnPWMjDP7V+YbUVkYYIFnJNMAutfIE1oco/ADewGQPjpTa/1WWrV6eUlmp+ AeZ4hTKmMHkj0AtB9u7K+M1xoehcDNzmeEs3oc/Sf3jT5Z0SxJ9NPXhArTr0to83 U3EQEnNDFb5zn9uXEj4Z =+g4M -----END PGP SIGNATURE-----
--jRHKVT23PllUwdXP--
--===============3497198943839608913== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline
-- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
--===============3497198943839608913==--
|
|
|
|