Input validation error in HttpComponents Client - CVE-2012-6153

Vulnerability identifier: #VU77628

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2012-6153

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to modify files on the system.

The vulnerability exists due to Apache Commons HttpClient does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate. A remote attacker can pass specially crafted input to the application and modify files on the system.

HttpComponents Client
IBM Tivoli Monitoring
IBM Cloud Application Performance Management (APM)
NetWorker
Control Desk
Netezza Appliance
Operations Analytics - Log Analysis
ApplinX
B2B Advanced Communications
Multi-Enterprise Integration Gateway
StreamSets Data Collector
IBM Engineering Lifecycle Optimization - Publishing
Storage Protect for Virtual Environments: Data Protection for VMware
Storage Protect for Space Management
Storage Protect Client
IBM Engineering Systems Design Rhapsody
watsonx.data
IBM Tivoli Application Dependency Discovery Manager
toolbox (Red Hat package)
rust-bootupd (Red Hat package)
python-oslo-metrics (Red Hat package)
python-autopage (Red Hat package)
containernetworking-plugins (Red Hat package)
python-scciclient (Red Hat package)
coreos-installer (Red Hat package)
butane (Red Hat package)
console-login-helper-messages (Red Hat package)
python-hardware (Red Hat package)
python-openstacksdk (Red Hat package)
runc (Red Hat package)
skopeo (Red Hat package)
python-oslo-upgradecheck (Red Hat package)
fuse-overlayfs (Red Hat package)
crun (Red Hat package)
containers-common (Red Hat package)
buildah (Red Hat package)
cri-tools (Red Hat package)
cri-o (Red Hat package)
haproxy (Red Hat package)
python-debtcollector (Red Hat package)
kata-containers (Red Hat package)
python-osc-lib (Red Hat package)
python-oslo-service (Red Hat package)
python-tooz (Red Hat package)
python-proliantutils (Red Hat package)
ignition (Red Hat package)
openvswitch2.16 (Red Hat package)
jenkins (Red Hat package)
podman (Red Hat package)
python-sushy-oem-idrac (Red Hat package)
python-ironic-prometheus-exporter (Red Hat package)
python-cachetools (Red Hat package)
python-oslo-context (Red Hat package)
python-stevedore (Red Hat package)
python-oslo-policy (Red Hat package)
python-cliff (Red Hat package)
python-sushy (Red Hat package)
python-oslo-serialization (Red Hat package)
python-keystoneauth1 (Red Hat package)
python-oslo-concurrency (Red Hat package)
python-oslo-log (Red Hat package)
python-ironicclient (Red Hat package)
python-oslo-utils (Red Hat package)
openshift-ansible (Red Hat package)
atomic-openshift-service-idler (Red Hat package)
openshift-kuryr (Red Hat package)
openshift-clients (Red Hat package)
openshift (Red Hat package)
jenkins-2-plugins (Red Hat package)
python-oslo-i18n (Red Hat package)
python-ironic-lib (Red Hat package)
rust-afterburn (Red Hat package)
python-pbr (Red Hat package)
python-dracclient (Red Hat package)
openstack-ironic-python-agent (Red Hat package)
python-oslo-config (Red Hat package)
python-oslo-db (Red Hat package)
openstack-ironic-inspector (Red Hat package)
python-oslo-messaging (Red Hat package)
openstack-ironic (Red Hat package)
ovn21.09 (Red Hat package)
ovn-2021 (Red Hat package)
ovn21.12 (Red Hat package)
redhat-release-coreos (Red Hat package)
Cloud Pak for Security (CP4S)
Red Hat OpenShift Container Platform
IBM Rational Asset Manager

Install updates from vendor's website.

HttpComponents Client - update to 4.2.3
Netezza Appliance - update to 1.0.0.1
Operations Analytics - Log Analysis - update to 1.3.8.3 IF1
watsonx.data - update to 2.2.1
toolbox (Red Hat package) - update to 0.0.8-4.rhaos4.10.el8
rust-bootupd (Red Hat package) - update to 0.2.5-3.rhaos4.10.el8
python-oslo-metrics (Red Hat package) - update to 0.3.0-0.20211020174122.43eee50.el8
python-autopage (Red Hat package) - update to 0.4.0-1.el8
containernetworking-plugins (Red Hat package) - update to 0.9.1-1.rhaos4.10.el8
python-scciclient (Red Hat package) - update to 0.11.1-0.20211208154124.a84332b.el8
coreos-installer (Red Hat package) - update to 0.12.0-1.rhaos4.10.el8
butane (Red Hat package) - update to 0.14.0-1.rhaos4.10.el8
console-login-helper-messages (Red Hat package) - update to 0.20.3-1.rhaos4.10.el8
python-hardware (Red Hat package) - update to 0.29.0-0.20211122094056.7662a1d.el8
python-openstacksdk (Red Hat package) - update to 0.59.0-0.20211012172340.d0d4d8b.el8
B2B Advanced Communications - update to 1.0.0.8
Multi-Enterprise Integration Gateway - update to 1.0.0.8
runc (Red Hat package) - addressed in versions 1.0.1-3.rhaos4.10.git4144b63.el7, 1.1.0-1.rhaos4.10.el8
skopeo (Red Hat package) - update to 1.2.2-1.rhaos4.10.el8
python-oslo-upgradecheck (Red Hat package) - update to 1.4.0-0.20211012144915.3ca8698.el8
fuse-overlayfs (Red Hat package) - update to 1.4.0-1.rhaos4.10.el8
crun (Red Hat package) - update to 1.4.2-1.rhaos4.10.el8
Cloud Pak for Security (CP4S) - update to 1.10.14.0
containers-common (Red Hat package) - update to 1-16.rhaos4.10.el8
buildah (Red Hat package) - update to 1.19.7-1.el8
cri-tools (Red Hat package) - addressed in versions 1.23.0-1.el7, 1.23.0-1.el8
cri-o (Red Hat package) - addressed in versions 1.23.0-92.rhaos4.10.gitdaab4d1.el7, 1.23.1-9.rhaos4.10.gitbdffb9a.el8
haproxy (Red Hat package) - update to 2.2.19-1.el8
python-debtcollector (Red Hat package) - update to 2.3.0-0.20211012161119.0bf5bf5.el8
kata-containers (Red Hat package) - update to 2.3.0-3.el8
python-osc-lib (Red Hat package) - update to 2.4.2-0.20211012163041.415a6c7.el8
python-oslo-service (Red Hat package) - update to 2.6.0-0.20211012154519.091fd65.el8
python-tooz (Red Hat package) - update to 2.9.0-0.20211012145018.174065f.el8
python-proliantutils (Red Hat package) - update to 2.12.2-0.20211210161243.500f518.el8
ignition (Red Hat package) - update to 2.13.0-2.rhaos4.10.el8
openvswitch2.16 (Red Hat package) - update to 2.16.0-33.el8fdp
jenkins (Red Hat package) - update to 2.319.2.1643288987-1.el8
podman (Red Hat package) - update to 3.0.1-7.rhaos4.10.el8
python-sushy-oem-idrac (Red Hat package) - update to 3.0.2-0.20211011174039.9733d23.el8
python-ironic-prometheus-exporter (Red Hat package) - update to 3.1.0-0.20211130174057.d25ba32.el8
python-cachetools (Red Hat package) - update to 3.1.0-2.el8ost
python-oslo-context (Red Hat package) - update to 3.3.1-0.20211012152439.641a1e0.el8
python-stevedore (Red Hat package) - update to 3.4.0-0.20211012153718.8846a3f.el8
python-oslo-policy (Red Hat package) - update to 3.8.2-0.20211012161944.c7fd9f4.el8
python-cliff (Red Hat package) - update to 3.9.0-0.20211020191737.734bc0c.el8
python-sushy (Red Hat package) - update to 4.0.0-0.20211209155954.45d24d4.el8
python-oslo-serialization (Red Hat package) - update to 4.2.0-0.20211012151454.2b94a4f.el8
python-keystoneauth1 (Red Hat package) - update to 4.4.0-0.20211012144044.112bcae.el8
python-oslo-concurrency (Red Hat package) - update to 4.4.1-0.20211012150632.8e08400.el8
python-oslo-log (Red Hat package) - update to 4.6.0-0.20211012154701.41c8807.el8
python-ironicclient (Red Hat package) - update to 4.9.0-0.20211209154934.6f1be06.el8
python-oslo-utils (Red Hat package) - update to 4.10.0-0.20211012164840.2c74bb9.el8
openshift-ansible (Red Hat package) - update to 4.10.0-202202110258.p0.g25af5a6.assembly.stream.el7
atomic-openshift-service-idler (Red Hat package) - update to 4.10.0-202202160023.p0.g39cfc66.assembly.stream.el8
openshift-kuryr (Red Hat package) - update to 4.10.0-202202160023.p0.ge77f917.assembly.stream.el8
openshift-clients (Red Hat package) - addressed in versions 4.10.0-202202160023.p0.gf93da17.assembly.stream.el7, 4.10.0-202202160023.p0.gf93da17.assembly.stream.el8
openshift (Red Hat package) - addressed in versions 4.10.0-202202250816.p0.ge419edf.assembly.stream.el7, 4.10.0-202202250816.p0.ge419edf.assembly.stream.el8
Red Hat OpenShift Container Platform - update to 4.10.3
jenkins-2-plugins (Red Hat package) - update to 4.10.1643404185-1.el8
python-oslo-i18n (Red Hat package) - update to 5.1.0-0.20211012165753.b031d17.el8
python-ironic-lib (Red Hat package) - update to 5.1.0-0.20211209154936.731e2f9.el8
rust-afterburn (Red Hat package) - update to 5.2.0-1.rhaos4.10.el8
python-pbr (Red Hat package) - update to 5.5.1-1.el8ost
StreamSets Data Collector - update to 7.0.0
python-dracclient (Red Hat package) - update to 7.0.0-0.20211012182751.d26664e.el8
IBM Engineering Lifecycle Optimization - Publishing - addressed in versions 7.0.2.36, 7.0.3.18, 7.1.0.5
IBM Rational Asset Manager - update to 7.5.4.15
IBM Cloud Application Performance Management (APM) - addressed in versions 8.1.4.0.16, 8.1.4.0.20
Storage Protect for Virtual Environments: Data Protection for VMware - update to 8.1.20.0
Storage Protect for Space Management - update to 8.1.20.0
Storage Protect Client - update to 8.1.20.0
openstack-ironic-python-agent (Red Hat package) - update to 8.3.1-0.20220105174059.d2d3cd6.el8
python-oslo-config (Red Hat package) - update to 8.7.1-0.20211012155707.1a7bd66.el8
IBM Engineering Systems Design Rhapsody - addressed in versions 9.0.1.0.6, 9.0.2.0.2
python-oslo-db (Red Hat package) - update to 9.1.0-0.20211020204148.be2cc6a.el8
openstack-ironic-inspector (Red Hat package) - update to 10.9.1-0.20220117094044.19e2592.el8
python-oslo-messaging (Red Hat package) - update to 12.9.1-0.20211020204149.f9de265.el8
openstack-ironic (Red Hat package) - update to 19.0.1-0.20220120204037.438b8af.el8
NetWorker - addressed in versions 19.9.0.6, 19.10.0.3
ovn21.09 (Red Hat package) - update to 21.09.0-22.el8fdp
ovn-2021 (Red Hat package) - update to 21.12.0-15.el8fdp
ovn21.12 (Red Hat package) - update to 21.12.0-25.el8fdp
redhat-release-coreos (Red Hat package) - update to 410.84-2.el8

• http://rhn.redhat.com/errata/RHSA-2014-1098.html
• http://rhn.redhat.com/errata/RHSA-2014-1833.html
• http://rhn.redhat.com/errata/RHSA-2014-1834.html
• http://rhn.redhat.com/errata/RHSA-2014-1835.html
• http://rhn.redhat.com/errata/RHSA-2014-1836.html
• http://rhn.redhat.com/errata/RHSA-2014-1891.html
• http://rhn.redhat.com/errata/RHSA-2014-1892.html
• http://rhn.redhat.com/errata/RHSA-2015-0125.html
• http://rhn.redhat.com/errata/RHSA-2015-0158.html
• http://rhn.redhat.com/errata/RHSA-2015-0675.html
• http://rhn.redhat.com/errata/RHSA-2015-0720.html
• http://rhn.redhat.com/errata/RHSA-2015-0765.html
• http://rhn.redhat.com/errata/RHSA-2015-0850.html
• http://rhn.redhat.com/errata/RHSA-2015-0851.html
• http://rhn.redhat.com/errata/RHSA-2015-1888.html
• http://svn.apache.org/viewvc?view=revision&revision=1411705
• http://www.securityfocus.com/bid/69257
• http://www.ubuntu.com/usn/USN-2769-1
• https://access.redhat.com/solutions/1165533
• https://bugzilla.redhat.com/show_bug.cgi?id=1129916
• https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05103564

• Multiple vulnerabilities in APM Linux KVM Agent
• Multiple vulnerabilities in IBM Control Desk
• Multiple vulnerabilities in IBM Tivoli Monitoring
• Multiple vulnerabilities in IBM Storage Protect Client, IBM Storage Protect for Virtual Environments, and IBM Storage Protect for Space Management
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• Multiple vulnerabilities in IBM B2B Advanced Communications and IBM Multi-Enterprise Integration Gateway
• Multiple vulnerabilities in IBM Tivoli Application Dependency Discovery Manager
• Multiple vulnerabilities in IBM Engineering Systems Design Rhapsody
• Multiple vulnerabilities in Dell NetWorker
• Multiple vulnerabilities in IBM Application Performance Management
• Multiple vulnerabilities in IBM Rational Asset Manager
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.10
• Multiple vulnerabilities in IBM watsonx.data
• Multiple vulnerabilities in IBM Engineering Lifecycle Optimization - Publishing
• Multiple vulnerabilities in IBM Netezza Appliance
• Multiple vulnerabilities in IBM StreamSets Data Collector
• Multiple vulnerabilities in IBM Operations Analytics - Log Analysis
• Multiple vulnerabilities in IBM ApplinX