Improper Certificate Validation in Apache HttpAsyncClient and HttpComponents Client - CVE-2014-3577

Vulnerability identifier: #VU57150

CSH Severity: Low

CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2014-3577

CWE-ID: CWE-295

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to improper certificate validation. A remote attacker can perform a man-in-the-middle (MitM) attack and spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate.

Apache HttpAsyncClient
Control Desk
DB2 on Cloud Pak for Data
DB2 Warehouse on Cloud Pak for Data
Multi-Enterprise Integration Gateway
B2B Advanced Communications
StreamSets Data Collector
Db2 Big SQL
Storage Protect Client
Storage Protect for Space Management
Storage Protect for Virtual Environments: Data Protection for VMware
IBM Engineering Systems Design Rhapsody
HttpComponents Client
IBM Tivoli Monitoring
IBM Intelligent Operations Center
IBM Security Verify Governance
IBM Spectrum Control
IBM Sterling Partner Engagement Manager
IBM Cloud Application Performance Management (APM)
NetWorker
IBM Cloud Pak for Business Automation
Jenkins
Jenkins LTS
Red Hat OpenShift Container Platform
Migration Toolkit for Containers
IBM Tivoli Application Dependency Discovery Manager
IBM DB2
toolbox (Red Hat package)
rust-bootupd (Red Hat package)
python-oslo-metrics (Red Hat package)
python-autopage (Red Hat package)
containernetworking-plugins (Red Hat package)
python-scciclient (Red Hat package)
coreos-installer (Red Hat package)
butane (Red Hat package)
console-login-helper-messages (Red Hat package)
python-hardware (Red Hat package)
python-openstacksdk (Red Hat package)
runc (Red Hat package)
skopeo (Red Hat package)
python-oslo-upgradecheck (Red Hat package)
fuse-overlayfs (Red Hat package)
crun (Red Hat package)
containers-common (Red Hat package)
buildah (Red Hat package)
cri-tools (Red Hat package)
cri-o (Red Hat package)
haproxy (Red Hat package)
python-debtcollector (Red Hat package)
kata-containers (Red Hat package)
python-osc-lib (Red Hat package)
python-oslo-service (Red Hat package)
python-tooz (Red Hat package)
python-proliantutils (Red Hat package)
ignition (Red Hat package)
openvswitch2.16 (Red Hat package)
jenkins (Red Hat package)
podman (Red Hat package)
python-sushy-oem-idrac (Red Hat package)
python-ironic-prometheus-exporter (Red Hat package)
python-cachetools (Red Hat package)
python-oslo-context (Red Hat package)
python-stevedore (Red Hat package)
python-oslo-policy (Red Hat package)
python-cliff (Red Hat package)
python-sushy (Red Hat package)
python-oslo-serialization (Red Hat package)
python-keystoneauth1 (Red Hat package)
python-oslo-concurrency (Red Hat package)
python-oslo-log (Red Hat package)
python-ironicclient (Red Hat package)
python-oslo-utils (Red Hat package)
openshift-ansible (Red Hat package)
atomic-openshift-service-idler (Red Hat package)
openshift-kuryr (Red Hat package)
openshift-clients (Red Hat package)
openshift (Red Hat package)
jenkins-2-plugins (Red Hat package)
python-oslo-i18n (Red Hat package)
python-ironic-lib (Red Hat package)
rust-afterburn (Red Hat package)
python-pbr (Red Hat package)
python-dracclient (Red Hat package)
openstack-ironic-python-agent (Red Hat package)
python-oslo-config (Red Hat package)
python-oslo-db (Red Hat package)
openstack-ironic-inspector (Red Hat package)
python-oslo-messaging (Red Hat package)
openstack-ironic (Red Hat package)
ovn21.09 (Red Hat package)
ovn-2021 (Red Hat package)
ovn21.12 (Red Hat package)
redhat-release-coreos (Red Hat package)
Voice Gateway
Cloud Pak for Security (CP4S)
IBM Cloud Pak System
IBM Rational Asset Manager

Install updates from vendor's website.

Apache HttpAsyncClient - update to 4.0.2
HttpComponents Client - update to 4.3.5
Jenkins - update to 2.315
Jenkins LTS - update to 2.303.2
Red Hat OpenShift Container Platform - addressed in versions 4.10.3, 4.12.4
IBM Intelligent Operations Center - update to 5.2.4
IBM DB2 - update to 11.5.8
toolbox (Red Hat package) - update to 0.0.8-4.rhaos4.10.el8
rust-bootupd (Red Hat package) - update to 0.2.5-3.rhaos4.10.el8
python-oslo-metrics (Red Hat package) - update to 0.3.0-0.20211020174122.43eee50.el8
python-autopage (Red Hat package) - update to 0.4.0-1.el8
containernetworking-plugins (Red Hat package) - update to 0.9.1-1.rhaos4.10.el8
python-scciclient (Red Hat package) - update to 0.11.1-0.20211208154124.a84332b.el8
coreos-installer (Red Hat package) - update to 0.12.0-1.rhaos4.10.el8
butane (Red Hat package) - update to 0.14.0-1.rhaos4.10.el8
console-login-helper-messages (Red Hat package) - update to 0.20.3-1.rhaos4.10.el8
python-hardware (Red Hat package) - update to 0.29.0-0.20211122094056.7662a1d.el8
python-openstacksdk (Red Hat package) - update to 0.59.0-0.20211012172340.d0d4d8b.el8
Multi-Enterprise Integration Gateway - update to 1.0.0.8
B2B Advanced Communications - update to 1.0.0.8
runc (Red Hat package) - addressed in versions 1.0.1-3.rhaos4.10.git4144b63.el7, 1.1.0-1.rhaos4.10.el8
Voice Gateway - update to 1.0.8.3
skopeo (Red Hat package) - update to 1.2.2-1.rhaos4.10.el8
python-oslo-upgradecheck (Red Hat package) - update to 1.4.0-0.20211012144915.3ca8698.el8
fuse-overlayfs (Red Hat package) - update to 1.4.0-1.rhaos4.10.el8
crun (Red Hat package) - update to 1.4.2-1.rhaos4.10.el8
Migration Toolkit for Containers - update to 1.5.4
Cloud Pak for Security (CP4S) - update to 1.10.14.0
containers-common (Red Hat package) - update to 1-16.rhaos4.10.el8
buildah (Red Hat package) - update to 1.19.7-1.el8
cri-tools (Red Hat package) - addressed in versions 1.23.0-1.el7, 1.23.0-1.el8
cri-o (Red Hat package) - addressed in versions 1.23.0-92.rhaos4.10.gitdaab4d1.el7, 1.23.1-9.rhaos4.10.gitbdffb9a.el8
haproxy (Red Hat package) - update to 2.2.19-1.el8
python-debtcollector (Red Hat package) - update to 2.3.0-0.20211012161119.0bf5bf5.el8
kata-containers (Red Hat package) - update to 2.3.0-3.el8
IBM Cloud Pak System - update to 2.3.3.7 iFix 01
python-osc-lib (Red Hat package) - update to 2.4.2-0.20211012163041.415a6c7.el8
python-oslo-service (Red Hat package) - update to 2.6.0-0.20211012154519.091fd65.el8
python-tooz (Red Hat package) - update to 2.9.0-0.20211012145018.174065f.el8
python-proliantutils (Red Hat package) - update to 2.12.2-0.20211210161243.500f518.el8
ignition (Red Hat package) - update to 2.13.0-2.rhaos4.10.el8
openvswitch2.16 (Red Hat package) - update to 2.16.0-33.el8fdp
jenkins (Red Hat package) - update to 2.319.2.1643288987-1.el8
podman (Red Hat package) - update to 3.0.1-7.rhaos4.10.el8
python-sushy-oem-idrac (Red Hat package) - update to 3.0.2-0.20211011174039.9733d23.el8
python-ironic-prometheus-exporter (Red Hat package) - update to 3.1.0-0.20211130174057.d25ba32.el8
python-cachetools (Red Hat package) - update to 3.1.0-2.el8ost
python-oslo-context (Red Hat package) - update to 3.3.1-0.20211012152439.641a1e0.el8
python-stevedore (Red Hat package) - update to 3.4.0-0.20211012153718.8846a3f.el8
python-oslo-policy (Red Hat package) - update to 3.8.2-0.20211012161944.c7fd9f4.el8
python-cliff (Red Hat package) - update to 3.9.0-0.20211020191737.734bc0c.el8
python-sushy (Red Hat package) - update to 4.0.0-0.20211209155954.45d24d4.el8
python-oslo-serialization (Red Hat package) - update to 4.2.0-0.20211012151454.2b94a4f.el8
python-keystoneauth1 (Red Hat package) - update to 4.4.0-0.20211012144044.112bcae.el8
python-oslo-concurrency (Red Hat package) - update to 4.4.1-0.20211012150632.8e08400.el8
python-oslo-log (Red Hat package) - update to 4.6.0-0.20211012154701.41c8807.el8
python-ironicclient (Red Hat package) - update to 4.9.0-0.20211209154934.6f1be06.el8
python-oslo-utils (Red Hat package) - update to 4.10.0-0.20211012164840.2c74bb9.el8
openshift-ansible (Red Hat package) - update to 4.10.0-202202110258.p0.g25af5a6.assembly.stream.el7
atomic-openshift-service-idler (Red Hat package) - update to 4.10.0-202202160023.p0.g39cfc66.assembly.stream.el8
openshift-kuryr (Red Hat package) - update to 4.10.0-202202160023.p0.ge77f917.assembly.stream.el8
openshift-clients (Red Hat package) - addressed in versions 4.10.0-202202160023.p0.gf93da17.assembly.stream.el7, 4.10.0-202202160023.p0.gf93da17.assembly.stream.el8
openshift (Red Hat package) - addressed in versions 4.10.0-202202250816.p0.ge419edf.assembly.stream.el7, 4.10.0-202202250816.p0.ge419edf.assembly.stream.el8
jenkins-2-plugins (Red Hat package) - update to 4.10.1643404185-1.el8
python-oslo-i18n (Red Hat package) - update to 5.1.0-0.20211012165753.b031d17.el8
python-ironic-lib (Red Hat package) - update to 5.1.0-0.20211209154936.731e2f9.el8
rust-afterburn (Red Hat package) - update to 5.2.0-1.rhaos4.10.el8
IBM Spectrum Control - update to 5.4.10.2
python-pbr (Red Hat package) - update to 5.5.1-1.el8ost
IBM Sterling Partner Engagement Manager - addressed in versions 6.1.2.8, 6.2.0.6, 6.2.1.3, 6.2.2.1
StreamSets Data Collector - update to 7.0.0
python-dracclient (Red Hat package) - update to 7.0.0-0.20211012182751.d26664e.el8
Db2 Big SQL - update to 7.5
IBM Rational Asset Manager - update to 7.5.4.15
IBM Cloud Application Performance Management (APM) - addressed in versions 8.1.4.0.16, 8.1.4.0.20
Storage Protect Client - update to 8.1.20.0
Storage Protect for Space Management - update to 8.1.20.0
Storage Protect for Virtual Environments: Data Protection for VMware - update to 8.1.20.0
openstack-ironic-python-agent (Red Hat package) - update to 8.3.1-0.20220105174059.d2d3cd6.el8
python-oslo-config (Red Hat package) - update to 8.7.1-0.20211012155707.1a7bd66.el8
IBM Engineering Systems Design Rhapsody - addressed in versions 9.0.1.0.6, 9.0.2.0.2
python-oslo-db (Red Hat package) - update to 9.1.0-0.20211020204148.be2cc6a.el8
openstack-ironic-inspector (Red Hat package) - update to 10.9.1-0.20220117094044.19e2592.el8
python-oslo-messaging (Red Hat package) - update to 12.9.1-0.20211020204149.f9de265.el8
openstack-ironic (Red Hat package) - update to 19.0.1-0.20220120204037.438b8af.el8
NetWorker - addressed in versions 19.9.0.6, 19.10.0.3
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.22, 22.0.2.6
ovn21.09 (Red Hat package) - update to 21.09.0-22.el8fdp
ovn-2021 (Red Hat package) - update to 21.12.0-15.el8fdp
ovn21.12 (Red Hat package) - update to 21.12.0-25.el8fdp
redhat-release-coreos (Red Hat package) - update to 410.84-2.el8

• http://seclists.org/fulldisclosure/2014/Aug/48
• http://packetstormsecurity.com/files/127913/Apache-HttpComponents-Man-In-The-Middle.html
• http://secunia.com/advisories/60713
• http://secunia.com/advisories/60589
• https://access.redhat.com/solutions/1165533
• http://rhn.redhat.com/errata/RHSA-2014-1146.html
• http://rhn.redhat.com/errata/RHSA-2014-1166.html
• http://rhn.redhat.com/errata/RHSA-2014-1892.html
• http://rhn.redhat.com/errata/RHSA-2014-1891.html
• http://rhn.redhat.com/errata/RHSA-2014-1836.html
• http://rhn.redhat.com/errata/RHSA-2014-1835.html
• http://rhn.redhat.com/errata/RHSA-2014-1834.html
• http://rhn.redhat.com/errata/RHSA-2014-1833.html
• http://rhn.redhat.com/errata/RHSA-2015-0158.html
• http://rhn.redhat.com/errata/RHSA-2015-0125.html
• http://rhn.redhat.com/errata/RHSA-2015-0675.html
• http://rhn.redhat.com/errata/RHSA-2015-0720.html
• http://rhn.redhat.com/errata/RHSA-2015-0765.html
• http://rhn.redhat.com/errata/RHSA-2015-0851.html
• http://rhn.redhat.com/errata/RHSA-2015-0850.html
• http://rhn.redhat.com/errata/RHSA-2015-1177.html
• http://rhn.redhat.com/errata/RHSA-2015-1176.html
• http://www.ubuntu.com/usn/USN-2769-1
• https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05103564
• http://www.securityfocus.com/bid/69258
• http://www.securitytracker.com/id/1030812
• http://www.osvdb.org/110143
• http://secunia.com/advisories/60466
• https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05363782
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95327
• http://rhn.redhat.com/errata/RHSA-2016-1931.html
• http://rhn.redhat.com/errata/RHSA-2016-1773.html
• http://rhn.redhat.com/errata/RHSA-2015-1888.html
• http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
• https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E
• https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E
• https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E
• https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c@%3Ccommits.cxf.apache.org%3E
• https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf@%3Ccommits.cxf.apache.org%3E
• https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4@%3Ccommits.cxf.apache.org%3E
• http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00032.html
• http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00033.html
• https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6@%3Ccommits.cxf.apache.org%3E
• https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4@%3Ccommits.cxf.apache.org%3E
• https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e@%3Ccommits.cxf.apache.org%3E
• http://www.openwall.com/lists/oss-security/2021/10/06/1

• Improper Certificate Validation in Apache HttpComponents HttpClient and HttpAsyncClient
• Multiple vulnerabilities in Jenkins and Jenkins LTS
• IBM Db2 Connect Server update for Apache HttpComponents
• Multiple vulnerabilities in OpenShift Container Platform 4.12
• Multiple vulnerabilities in IBM Sterling Partner Engagement Manager
• Multiple vulnerabilities in APM Linux KVM Agent
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data
• Multiple vulnerabilities in IBM Intelligent Operations Center
• Multiple vulnerabilities in IBM Control Desk
• Multiple vulnerabilities in IBM Tivoli Monitoring
• Multiple vulnerabilities in IBM Voice Gateway
• Multiple vulnerabilities in IBM Storage Protect Client, IBM Storage Protect for Virtual Environments, and IBM Storage Protect for Space Management
• Multiple vulnerabilities in IBM Spectrum Control
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• Multiple vulnerabilities in IBM B2B Advanced Communications and IBM Multi-Enterprise Integration Gateway
• Multiple vulnerabilities in IBM Tivoli Application Dependency Discovery Manager
• Multiple vulnerabilities in IBM Cloud Pak System
• Multiple vulnerabilities in IBM Security Verify Governance - Identity Manager
• Multiple vulnerabilities in IBM Engineering Systems Design Rhapsody
• Multiple vulnerabilities in Dell NetWorker
• Multiple vulnerabilities in IBM Application Performance Management
• Multiple vulnerabilities in IBM Rational Asset Manager
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.10
• Multiple vulnerabilities in Migration Toolkit for Containers 1.5
• Multiple vulnerabilities in IBM Big SQL
• Multiple vulnerabilities in IBM StreamSets Data Collector