CVE-2013-4366

Published: Oct 30, 2017Modified: May 13, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509HostnameVerifier is not null, which allows attackers to have unspecified impact via vectors involving hostname verification.

Affected (4)

Products: Apache: Httpclient

Apache

1 product

Httpclient

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Apache Httpclient	Version 4.3
Apache Httpclient	Version 4.3 alpha1
Apache Httpclient	Version 4.3 beta1
Apache Httpclient	Version 4.3 beta2

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (4)

http://svn.apache.org/r1528614

Source: secalert@redhat.com

Issue TrackingPatchRelease NotesVendor Advisory

http://www.apache.org/dist/httpcomponents/httpclient/RELEASE_NOTES-4.3.x.txt

Source: secalert@redhat.com

Issue TrackingRelease NotesVendor Advisory

http://svn.apache.org/r1528614

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchRelease NotesVendor Advisory

http://www.apache.org/dist/httpcomponents/httpclient/RELEASE_NOTES-4.3.x.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingRelease NotesVendor Advisory

Timeline

No history available yet.