CVE-2015-5262

Published: Oct 27, 2015Modified: May 6, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.

Affected (7)

Products: Canonical: Ubuntu Linux · Fedoraproject: Fedora · Apache: Httpclient

1 product

1 product

1 product

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 15.04
Fedoraproject Fedora	Version 21
Fedoraproject Fedora	Version 22
Fedoraproject Fedora	Version 23

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Apache Httpclient	From 4.3 to 4.3.5

Related CWEs

References (30)

http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167962.html

Source: secalert@redhat.com

Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167999.html

Source: secalert@redhat.com

Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168030.html

Source: secalert@redhat.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00032.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00033.html

Source: secalert@redhat.com

http://svn.apache.org/viewvc?view=revision&revision=1626784

Source: secalert@redhat.com

Vendor Advisory

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

Source: secalert@redhat.com

http://www.securitytracker.com/id/1033743

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-2769-1

Source: secalert@redhat.com

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1261538

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

https://issues.apache.org/jira/browse/HTTPCLIENT-1478

Source: secalert@redhat.com

Vendor Advisory

https://jenkins.io/security/advisory/2018-02-26/

Source: secalert@redhat.com

Third Party Advisory

https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167962.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167999.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168030.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00032.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00033.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://svn.apache.org/viewvc?view=revision&revision=1626784

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id/1033743

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-2769-1

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1261538

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

https://issues.apache.org/jira/browse/HTTPCLIENT-1478

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://jenkins.io/security/advisory/2018-02-26/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.