Dependency-Check Report

Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.

Scan Information (show all):

dependency-check version: 1.4.5
Report Generated On: Mar 12, 2017 at 00:07:55 EST
Dependencies Scanned: 16 (15 unique)
Vulnerable Dependencies: 2
Vulnerabilities Found: 4
Vulnerabilities Suppressed: 0
...
CurrentEngineRelease:
NVD CVE 2002: 19/02/2017 03:25:58
NVD CVE 2003: 19/02/2017 03:24:25
NVD CVE 2004: 19/02/2017 03:23:59
NVD CVE 2005: 24/02/2017 03:12:32
NVD CVE 2006: 19/02/2017 03:20:36
NVD CVE 2007: 19/02/2017 03:18:20
NVD CVE 2008: 19/02/2017 03:16:18
NVD CVE 2009: 19/02/2017 03:14:03
NVD CVE 2010: 09/02/2017 03:09:26
NVD CVE 2011: 19/02/2017 03:11:57
NVD CVE 2012: 24/02/2017 03:11:07
NVD CVE 2013: 24/02/2017 03:09:00
NVD CVE 2014: 01/03/2017 03:07:38
NVD CVE 2015: 04/03/2017 03:06:02
NVD CVE 2016: 05/03/2017 03:02:53
NVD CVE 2017: 05/03/2017 03:00:24
NVD CVE Checked: 11/03/2017 23:34:50
NVD CVE Modified: 11/03/2017 20:00:24
VersionCheckOn: 1486838497071

Display: Showing Vulnerable Dependencies (click to show all)

Dependency	CPE	GAV	Highest Severity	CVE Count	CPE Confidence	Evidence Count
avalon-framework-4.1.3.jar		avalon-framework:avalon-framework:4.1.3		0		12
commons-codec-1.10.jar		commons-codec:commons-codec:1.10		0		25
commons-logging-1.1.jar		commons-logging:commons-logging:1.1		0		19
geronimo-spec-j2ee-connector-1.5-rc4.jar	cpe:/a:apache:geronimo:1.5.rc4	geronimo-spec:geronimo-spec-j2ee-connector:1.5-rc4	High	2	LOW	14
activation-1.1.jar		javax.activation:activation:1.1		0		17
mail-1.4.7.jar	cpe:/a:sun:javamail:1.4.7	javax.mail:mail:1.4.7		0	LOW	26
servlet-api-2.5.jar		javax.servlet:servlet-api:2.5		0		11
log4j-1.2.17.jar		log4j:log4j:1.2.17		0		18
logkit-1.0.1.jar		logkit:logkit:1.0.1		0		11
commons-lang3-3.5.jar		org.apache.commons:commons-lang3:3.5		0		27
geronimo-j2ee_1.4_spec-1.1.jar		org.apache.geronimo.specs:geronimo-j2ee_1.4_spec:1.1		0		8
httpclient-4.3.3.jar	cpe:/a:apache:httpclient:4.3.3	org.apache.httpcomponents:httpclient:4.3.3	Medium	2	HIGHEST	22
httpcore-4.3.2.jar		org.apache.httpcomponents:httpcore:4.3.2		0		22
qpid-client-6.0.0.jar	cpe:/a:apache:qpid:6.0.0	org.apache.qpid:qpid-client:6.0.0		0	LOW	19
slf4j-api-1.7.7.jar		org.slf4j:slf4j-api:1.7.7		0		20

Dependencies

avalon-framework-4.1.3.jar

File Path: C:\Users\Dad\.m2\repository\avalon-framework\avalon-framework\4.1.3\avalon-framework-4.1.3.jar
MD5: bef9f9be8ba066273fdef72b3503a307
SHA1: 92315ee1c4a4c90bee05055713811f28f8509075
Referenced In Project/Scope: fgsms Status (Bueller) Agent:compile

Evidence

Source	Name	Value
central	artifactid	avalon-framework
central	groupid	avalon-framework
central	version	4.1.3
file	name	avalon-framework
file	version	4.1.3
Manifest	extension-name	avalon-framework
Manifest	Implementation-Vendor	Apache Software Foundation
Manifest	Implementation-Version	4.1.3
Manifest	specification-vendor	Apache Software Foundation
pom	artifactid	avalon-framework
pom	groupid	avalon-framework
pom	version	4.1.3

Identifiers

maven: avalon-framework:avalon-framework:4.1.3 Confidence:HIGHEST

commons-codec-1.10.jar

Description: The Apache Commons Codec package contains simple encoder and decoders for various formats such as Base64 and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Dad\.m2\repository\commons-codec\commons-codec\1.10\commons-codec-1.10.jar
MD5: 353cf6a2bdba09595ccfa073b78c7fcb
SHA1: 4b95f4897fa13f2cd904aee711aeafc0c5295cd8
Referenced In Project/Scope: fgsms Status (Bueller) Agent:compile

Evidence

Source	Name	Value
central	artifactid	commons-codec
central	groupid	commons-codec
central	version	1.10
file	name	commons-codec
file	version	1.10
manifest	Bundle-Description	The Apache Commons Codec package contains simple encoder and decoders for various formats such as Base64 and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities.
Manifest	bundle-docurl	http://commons.apache.org/proper/commons-codec/
Manifest	Bundle-Name	Apache Commons Codec
Manifest	bundle-symbolicname	org.apache.commons.codec
Manifest	implementation-build	trunk@r1637108; 2014-11-06 14:14:12+0000
Manifest	Implementation-Title	Apache Commons Codec
Manifest	Implementation-Vendor	The Apache Software Foundation
Manifest	Implementation-Vendor-Id	org.apache
Manifest	Implementation-Version	1.10
Manifest	require-capability	osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))"
Manifest	specification-title	Apache Commons Codec
Manifest	specification-vendor	The Apache Software Foundation
pom	artifactid	commons-codec
pom	description	The Apache Commons Codec package contains simple encoder and decoders for various formats such as Base64 and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities.
pom	groupid	commons-codec
pom	name	Apache Commons Codec
pom	parent-artifactid	commons-parent
pom	parent-groupid	org.apache.commons
pom	url	http://commons.apache.org/proper/commons-codec/
pom	version	1.10

Identifiers

maven: commons-codec:commons-codec:1.10 Confidence:HIGHEST

commons-logging-1.1.jar

Description: Commons Logging is a thin adapter allowing configurable bridging to other, well known logging systems.

License:

The Apache Software License, Version 2.0: /LICENSE.txt

File Path: C:\Users\Dad\.m2\repository\commons-logging\commons-logging\1.1\commons-logging-1.1.jar
MD5: 6b62417e77b000a87de66ee3935edbf5
SHA1: ba24d5de831911b684c92cd289ed5ff826271824
Referenced In Project/Scope: fgsms Status (Bueller) Agent:compile

Evidence

Source	Name	Value
central	artifactid	commons-logging
central	groupid	commons-logging
central	version	1.1
file	name	commons-logging
file	version	1.1
Manifest	extension-name	org.apache.commons.logging
Manifest	Implementation-Title	Jakarta Commons Logging
Manifest	Implementation-Vendor	Apache Software Foundation
Manifest	Implementation-Vendor-Id	org.apache
Manifest	Implementation-Version	1.1
Manifest	specification-title	Jakarta Commons Logging
Manifest	specification-vendor	Apache Software Foundation
pom	artifactid	commons-logging
pom	description	Commons Logging is a thin adapter allowing configurable bridging to other, well known logging systems.
pom	groupid	commons-logging
pom	name	Logging
pom	organization name	http://jakarta.apache.org
pom	url	http://jakarta.apache.org/commons/${pom.artifactId.substring(8)}/
pom	version	1.1

Identifiers

maven: commons-logging:commons-logging:1.1 Confidence:HIGHEST

geronimo-spec-j2ee-connector-1.5-rc4.jar

File Path: C:\Users\Dad\.m2\repository\geronimo-spec\geronimo-spec-j2ee-connector\1.5-rc4\geronimo-spec-j2ee-connector-1.5-rc4.jar
MD5: 6a2ccbc1d0af6329c00b2089ae1a31d7
SHA1: 2f5310631817f11c5b170d3a0084a58766d49269
Referenced In Project/Scope: fgsms Status (Bueller) Agent:compile

Evidence

Source	Name	Value
central	artifactid	geronimo-spec-j2ee-connector
central	groupid	geronimo-spec
central	version	1.5-rc4
file	name	geronimo-spec-j2ee-connector
file	version	1.5.rc4
Manifest	extension-name	geronimo-spec-j2ee-connector
Manifest	Implementation-Title	javax.resource
Manifest	Implementation-Vendor	Apache Software Foundation
Manifest	Implementation-Version	1.5-rc4
Manifest	specification-title	J2EE Connector Architecture
Manifest	specification-vendor	Apache Software Foundation
pom	artifactid	geronimo-spec-j2ee-connector
pom	groupid	geronimo-spec
pom	version	1.5-rc4

Identifiers

cpe: cpe:/a:apache:geronimo:1.5.rc4 Confidence:LOW
maven: geronimo-spec:geronimo-spec-j2ee-connector:1.5-rc4 Confidence:HIGHEST

Published Vulnerabilities

CVE-2011-5034

Severity: High
CVSS Score: 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C)
CWE: CWE-20 Improper Input Validation

Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. NOTE: this might overlap CVE-2011-4461.

Vulnerable Software & Versions: (show all)

cpe:/a:apache:geronimo:2.2.1 and all previous versions
...
cpe:/a:apache:geronimo:1.0
cpe:/a:apache:geronimo:1.1
cpe:/a:apache:geronimo:1.1.1
cpe:/a:apache:geronimo:1.2
cpe:/a:apache:geronimo:2.0.1
cpe:/a:apache:geronimo:2.0.2
cpe:/a:apache:geronimo:2.1
cpe:/a:apache:geronimo:2.1.1
cpe:/a:apache:geronimo:2.1.2
cpe:/a:apache:geronimo:2.1.3
cpe:/a:apache:geronimo:2.1.4
cpe:/a:apache:geronimo:2.1.5
cpe:/a:apache:geronimo:2.1.6
cpe:/a:apache:geronimo:2.1.7
cpe:/a:apache:geronimo:2.1.8
cpe:/a:apache:geronimo:2.2
cpe:/a:apache:geronimo:2.2.1 and all previous versions

CVE-2008-0732

Severity: Low
CVSS Score: 2.1 (AV:L/AC:L/Au:N/C:P/I:N/A:N)
CWE: CWE-59 Improper Link Resolution Before File Access ('Link Following')

The init script for Apache Geronimo on SUSE Linux follows symlinks when performing a chown operation, which might allow local users to obtain access to unspecified files or directories.

SUSE - SUSE-SR:2008:003

Vulnerable Software & Versions:

cpe:/a:apache:geronimo

activation-1.1.jar

Description: JavaBeans Activation Framework (JAF) is a standard extension to the Java platform that lets you take advantage of standard services to: determine the type of an arbitrary piece of data; encapsulate access to it; discover the operations available on it; and instantiate the appropriate bean to perform the operation(s).

License:

Common Development and Distribution License (CDDL) v1.0: https://glassfish.dev.java.net/public/CDDLv1.0.html

File Path: C:\Users\Dad\.m2\repository\javax\activation\activation\1.1\activation-1.1.jar
MD5: 8ae38e87cd4f86059c0294a8fe3e0b18
SHA1: e6cb541461c2834bdea3eb920f1884d1eb508b50
Referenced In Project/Scope: fgsms Status (Bueller) Agent:compile

Evidence

Source	Name	Value
central	artifactid	activation
central	groupid	javax.activation
central	version	1.1
file	name	activation
file	version	1.1
Manifest	extension-name	javax.activation
Manifest	Implementation-Vendor	Sun Microsystems, Inc.
Manifest	Implementation-Vendor-Id	com.sun
Manifest	Implementation-Version	1.1
Manifest	specification-title	JavaBeans(TM) Activation Framework Specification
Manifest	specification-vendor	Sun Microsystems, Inc.
pom	artifactid	activation
pom	description	JavaBeans Activation Framework (JAF) is a standard extension to the Java platform that lets you take advantage of standard services to: determine the type of an arbitrary piece of data; encapsulate access to it; discover the operations available on it; and instantiate the appropriate bean to perform the operation(s).
pom	groupid	javax.activation
pom	name	JavaBeans Activation Framework (JAF)
pom	url	http://java.sun.com/products/javabeans/jaf/index.jsp
pom	version	1.1

Identifiers

maven: javax.activation:activation:1.1 Confidence:HIGHEST

mail-1.4.7.jar

Description: JavaMail API (compat)

License:

http://www.sun.com/cddl, https://glassfish.java.net/public/CDDL+GPL_1_1.html

File Path: C:\Users\Dad\.m2\repository\javax\mail\mail\1.4.7\mail-1.4.7.jar
MD5: 77f53ff0c78ba43c4812ecc9f53e20f8
SHA1: 9add058589d5d85adeb625859bf2c5eeaaedf12d
Referenced In Project/Scope: fgsms Status (Bueller) Agent:compile

Evidence

Source	Name	Value
central	artifactid	mail
central	groupid	javax.mail
central	version	1.4.7
file	name	mail
file	version	1.4.7
manifest	Bundle-Description	JavaMail API (compat)
Manifest	bundle-docurl	http://www.oracle.com
Manifest	Bundle-Name	JavaMail API (compat)
Manifest	bundle-symbolicname	javax.mail
Manifest	extension-name	javax.mail
Manifest	Implementation-Title	javax.mail
Manifest	Implementation-Vendor	Oracle
Manifest	Implementation-Vendor-Id	com.sun
Manifest	Implementation-Version	1.4.7
Manifest	originally-created-by	1.7.0_15 (Oracle Corporation)
Manifest	probe-provider-xml-file-names	META-INF/gfprobe-provider.xml
Manifest	specification-title	JavaMail(TM) API Design Specification
Manifest	specification-vendor	Oracle
Manifest (hint)	Implementation-Vendor	sun
Manifest (hint)	specification-vendor	sun
pom	artifactid	mail
pom	groupid	javax.mail
pom	name	JavaMail API (compat)
pom	parent-artifactid	all
pom	parent-groupid	com.sun.mail
pom	version	1.4.7

Identifiers

cpe: cpe:/a:sun:javamail:1.4.7 Confidence:LOW
maven: javax.mail:mail:1.4.7 Confidence:HIGHEST

servlet-api-2.5.jar

File Path: C:\Users\Dad\.m2\repository\javax\servlet\servlet-api\2.5\servlet-api-2.5.jar
MD5: 116fc16f3f700d756a57a2b8ea7c1044
SHA1: e69999122202bb1c275a80ad3281c4f69f2ea0b2
Referenced In Project/Scope: fgsms Status (Bueller) Agent:compile

Evidence

Source	Name	Value
file	name	servlet-api
file	version	2.5
Manifest	extension-name	javax.servlet
Manifest	Implementation-Vendor	Sun Microsystems, Inc.
Manifest	Implementation-Vendor-Id	org.apache
Manifest	Implementation-Version	2.5
Manifest	specification-title	JavaServlet(TM) Specification
Manifest	specification-vendor	Sun Microsystems, Inc.
pom	artifactid	servlet-api
pom	groupid	javax.servlet
pom	version	2.5

Identifiers

maven: javax.servlet:servlet-api:2.5 Confidence:HIGH

log4j-1.2.17.jar

Description: Apache Log4j 1.2

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Dad\.m2\repository\log4j\log4j\1.2.17\log4j-1.2.17.jar
MD5: 04a41f0a068986f0f73485cf507c0f40
SHA1: 5af35056b4d257e4b64b9e8069c0746e8b08629f
Referenced In Project/Scope: fgsms Status (Bueller) Agent:compile

Evidence

Source	Name	Value
central	artifactid	log4j
central	groupid	log4j
central	version	1.2.17
file	name	log4j
file	version	1.2.17
manifest	Bundle-Description	Apache Log4j 1.2
Manifest	bundle-docurl	http://logging.apache.org/log4j/1.2
Manifest	Bundle-Name	Apache Log4j
Manifest	bundle-symbolicname	log4j
manifest: org.apache.log4j	Implementation-Title	log4j
manifest: org.apache.log4j	Implementation-Vendor	"Apache Software Foundation"
pom	artifactid	log4j
pom	description	Apache Log4j 1.2
pom	groupid	log4j
pom	name	Apache Log4j
pom	organization name	http://www.apache.org
pom	url	http://logging.apache.org/log4j/1.2/
pom	version	1.2.17

Identifiers

maven: log4j:log4j:1.2.17 Confidence:HIGHEST

logkit-1.0.1.jar

File Path: C:\Users\Dad\.m2\repository\logkit\logkit\1.0.1\logkit-1.0.1.jar
MD5: 32240100a5c15d53f00392fae4b0aab7
SHA1: aaf5649b523c5ffc925e746074979150bb74bfdc
Referenced In Project/Scope: fgsms Status (Bueller) Agent:compile

Evidence

Source	Name	Value
central	artifactid	logkit
central	groupid	logkit
central	version	1.0.1
file	name	logkit
file	version	1.0.1
jar	package name	apache
jar	package name	log
jar	package name	output
pom	artifactid	logkit
pom	groupid	logkit
pom	version	1.0.1

Identifiers

maven: logkit:logkit:1.0.1 Confidence:HIGHEST

commons-lang3-3.5.jar

Description: Apache Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Dad\.m2\repository\org\apache\commons\commons-lang3\3.5\commons-lang3-3.5.jar
MD5: 780b5a8b72eebe6d0dbff1c11b5658fa
SHA1: 6c6c702c89bfff3cd9e80b04d668c5e190d588c6
Referenced In Project/Scope: fgsms Status (Bueller) Agent:compile

Evidence

Source	Name	Value
central	artifactid	commons-lang3
central	groupid	org.apache.commons
central	version	3.5
file	name	commons-lang3
file	version	3.5
manifest	Bundle-Description	Apache Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang.
Manifest	bundle-docurl	http://commons.apache.org/proper/commons-lang/
Manifest	Bundle-Name	Apache Commons Lang
Manifest	bundle-symbolicname	org.apache.commons.lang3
Manifest	implementation-build	release@r36f98d87b24c2f542b02abbf6ec1ee742f1b158b; 2016-10-13 19:52:17+0000
Manifest	Implementation-Title	Apache Commons Lang
Manifest	implementation-url	http://commons.apache.org/proper/commons-lang/
Manifest	Implementation-Vendor	The Apache Software Foundation
Manifest	Implementation-Vendor-Id	org.apache
Manifest	Implementation-Version	3.5
Manifest	require-capability	osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))"
Manifest	specification-title	Apache Commons Lang
Manifest	specification-vendor	The Apache Software Foundation
pom	artifactid	commons-lang3
pom	description	Apache Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang.
pom	groupid	apache.commons
pom	groupid	org.apache.commons
pom	name	Apache Commons Lang
pom	parent-artifactid	commons-parent
pom	parent-groupid	org.apache.commons
pom	url	http://commons.apache.org/proper/commons-lang/
pom	version	3.5

Identifiers

maven: org.apache.commons:commons-lang3:3.5 Confidence:HIGHEST

geronimo-j2ee_1.4_spec-1.1.jar

File Path: C:\Users\Dad\.m2\repository\org\apache\geronimo\specs\geronimo-j2ee_1.4_spec\1.1\geronimo-j2ee_1.4_spec-1.1.jar
MD5: e543bc5784a12d37bdac8eafa49164d6
SHA1: eca7ea0d0683f270bc7e67bb4d7714835962f16c
Referenced In Project/Scope: fgsms Status (Bueller) Agent:compile

Evidence

Source	Name	Value
central	artifactid	geronimo-j2ee_1.4_spec
central	groupid	org.apache.geronimo.specs
central	version	1.1
file	name	geronimo-j2ee_1.4_spec-1.1
jar	package name	omg
pom	artifactid	geronimo-j2ee_1.4_spec
pom	groupid	org.apache.geronimo.specs
pom	version	1.1

Identifiers

maven: org.apache.geronimo.specs:geronimo-j2ee_1.4_spec:1.1 Confidence:HIGHEST

httpclient-4.3.3.jar

Description: HttpComponents Client

File Path: C:\Users\Dad\.m2\repository\org\apache\httpcomponents\httpclient\4.3.3\httpclient-4.3.3.jar
MD5: 88cc3123fce88d61b7c2cdbfc33542c5
SHA1: 18f4247ff4572a074444572cee34647c43e7c9c7
Referenced In Project/Scope: fgsms Status (Bueller) Agent:compile

Evidence

Source	Name	Value
central	artifactid	httpclient
central	groupid	org.apache.httpcomponents
central	version	4.3.3
file	name	httpclient
file	version	4.3.3
Manifest	implementation-build	tags/4.3.3-RC1/httpclient@r1570731; 2014-02-22 09:04:11-0500
Manifest	Implementation-Title	HttpComponents Apache HttpClient
Manifest	Implementation-Vendor	The Apache Software Foundation
Manifest	Implementation-Vendor-Id	org.apache
Manifest	Implementation-Version	4.3.3
Manifest	specification-title	HttpComponents Apache HttpClient
Manifest	specification-vendor	The Apache Software Foundation
Manifest	url	http://hc.apache.org/httpcomponents-client
pom	artifactid	httpclient
pom	description	HttpComponents Client
pom	groupid	apache.httpcomponents
pom	groupid	org.apache.httpcomponents
pom	name	Apache HttpClient
pom	parent-artifactid	httpcomponents-client
pom	parent-groupid	org.apache.httpcomponents
pom	url	http://hc.apache.org/httpcomponents-client
pom	version	4.3.3

Identifiers

cpe: cpe:/a:apache:httpclient:4.3.3 Confidence:HIGHEST
maven: org.apache.httpcomponents:httpclient:4.3.3 Confidence:HIGHEST

Published Vulnerabilities

CVE-2015-5262

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-399 Resource Management Errors

http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.

CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1626784
CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1261538
CONFIRM - https://issues.apache.org/jira/browse/HTTPCLIENT-1478
FEDORA - FEDORA-2015-15588
FEDORA - FEDORA-2015-15589
FEDORA - FEDORA-2015-15590
SECTRACK - 1033743
UBUNTU - USN-2769-1

Vulnerable Software & Versions:

cpe:/a:apache:httpclient:4.3.5 and all previous versions

CVE-2014-3577

Severity: Medium
CVSS Score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)

org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field.

BID - 69258
CONFIRM - https://access.redhat.com/solutions/1165533
CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05103564
CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05363782
FULLDISC - 20140818 CVE-2014-3577: Apache HttpComponents client: Hostname verification susceptible to MITM attack
MISC - http://packetstormsecurity.com/files/127913/Apache-HttpComponents-Man-In-The-Middle.html
OSVDB - 110143
REDHAT - RHSA-2014:1146
REDHAT - RHSA-2014:1166
REDHAT - RHSA-2014:1833
REDHAT - RHSA-2014:1834
REDHAT - RHSA-2014:1835
REDHAT - RHSA-2014:1836
REDHAT - RHSA-2014:1891
REDHAT - RHSA-2014:1892
REDHAT - RHSA-2015:0125
REDHAT - RHSA-2015:0158
REDHAT - RHSA-2015:0675
REDHAT - RHSA-2015:0720
REDHAT - RHSA-2015:0765
REDHAT - RHSA-2015:0850
REDHAT - RHSA-2015:0851
REDHAT - RHSA-2015:1176
REDHAT - RHSA-2015:1177
SECTRACK - 1030812
SECUNIA - 60466
UBUNTU - USN-2769-1
XF - apache-cve20143577-spoofing(95327)

Vulnerable Software & Versions: (show all)

httpcore-4.3.2.jar

Description: HttpComponents Core (blocking I/O)

File Path: C:\Users\Dad\.m2\repository\org\apache\httpcomponents\httpcore\4.3.2\httpcore-4.3.2.jar
MD5: ee3d34dce4a30c7d3002cadf8c9172c1
SHA1: 31fbbff1ddbf98f3aa7377c94d33b0447c646b6e
Referenced In Project/Scope: fgsms Status (Bueller) Agent:compile

Evidence

Source	Name	Value
central	artifactid	httpcore
central	groupid	org.apache.httpcomponents
central	version	4.3.2
file	name	httpcore
file	version	4.3.2
Manifest	implementation-build	UNKNOWN_BRANCH@r??????; 2014-02-12 21:43:05+0100
Manifest	Implementation-Title	HttpComponents Apache HttpCore
Manifest	Implementation-Vendor	The Apache Software Foundation
Manifest	Implementation-Vendor-Id	org.apache
Manifest	Implementation-Version	4.3.2
Manifest	specification-title	HttpComponents Apache HttpCore
Manifest	specification-vendor	The Apache Software Foundation
Manifest	url	http://hc.apache.org/httpcomponents-core-ga
pom	artifactid	httpcore
pom	description	HttpComponents Core (blocking I/O)
pom	groupid	apache.httpcomponents
pom	groupid	org.apache.httpcomponents
pom	name	Apache HttpCore
pom	parent-artifactid	httpcomponents-core
pom	parent-groupid	org.apache.httpcomponents
pom	url	http://hc.apache.org/httpcomponents-core-ga
pom	version	4.3.2

Identifiers

maven: org.apache.httpcomponents:httpcore:4.3.2 Confidence:HIGHEST

qpid-client-6.0.0.jar

Description: JMS client supporting AMQP 0-8, 0-9, 0-9-1 and 0-10.

File Path: C:\Users\Dad\.m2\repository\org\apache\qpid\qpid-client\6.0.0\qpid-client-6.0.0.jar
MD5: 244a004182de831f2ff3774dbac2741f
SHA1: 0a4c3e81e2c4777bf3d50c293391831a5dd1acf9
Referenced In Project/Scope: fgsms Status (Bueller) Agent:compile

Evidence

Source	Name	Value
central	artifactid	qpid-client
central	groupid	org.apache.qpid
central	version	6.0.0
file	name	qpid-client
file	version	6.0.0
Manifest	Implementation-Title	Qpid AMQP 0-x JMS Client
Manifest	Implementation-Vendor	The Apache Software Foundation
Manifest	Implementation-Vendor-Id	org.apache.qpid
Manifest	Implementation-Version	6.0.0
Manifest	specification-title	Qpid AMQP 0-x JMS Client
Manifest	specification-vendor	The Apache Software Foundation
pom	artifactid	qpid-client
pom	description	JMS client supporting AMQP 0-8, 0-9, 0-9-1 and 0-10.
pom	groupid	apache.qpid
pom	groupid	org.apache.qpid
pom	name	Qpid AMQP 0-x JMS Client
pom	parent-artifactid	qpid-java-build
pom	parent-groupid	org.apache.qpid
pom	version	6.0.0

Related Dependencies

Identifiers

cpe: cpe:/a:apache:qpid:6.0.0 Confidence:LOW
maven: org.apache.qpid:qpid-client:6.0.0 Confidence:HIGHEST

slf4j-api-1.7.7.jar

Description: The slf4j API

File Path: C:\Users\Dad\.m2\repository\org\slf4j\slf4j-api\1.7.7\slf4j-api-1.7.7.jar
MD5: ca4280bf93d64367723ae5c8d42dd0b9
SHA1: 2b8019b6249bb05d81d3a3094e468753e2b21311
Referenced In Project/Scope: fgsms Status (Bueller) Agent:compile

Evidence

Source	Name	Value
central	artifactid	slf4j-api
central	groupid	org.slf4j
central	version	1.7.7
file	name	slf4j-api
file	version	1.7.7
manifest	Bundle-Description	The slf4j API
Manifest	Bundle-Name	slf4j-api
Manifest	bundle-requiredexecutionenvironment	J2SE-1.3
Manifest	bundle-symbolicname	slf4j.api
Manifest	Implementation-Title	slf4j-api
Manifest	Implementation-Version	1.7.7
pom	artifactid	slf4j-api
pom	description	The slf4j API
pom	groupid	org.slf4j
pom	groupid	slf4j
pom	name	SLF4J API Module
pom	parent-artifactid	slf4j-parent
pom	parent-groupid	org.slf4j
pom	url	http://www.slf4j.org
pom	version	1.7.7

Identifiers

maven: org.slf4j:slf4j-api:1.7.7 Confidence:HIGHEST

How to read the report | Suppressing false positives | Getting Help: google group | github issues

Project: fgsms Status (Bueller) Agent

Dependencies

avalon-framework-4.1.3.jar

Evidence

Identifiers

commons-codec-1.10.jar

Evidence

Identifiers

commons-logging-1.1.jar

Evidence

Identifiers

geronimo-spec-j2ee-connector-1.5-rc4.jar

Evidence

Identifiers

Published Vulnerabilities

activation-1.1.jar

Evidence

Identifiers

mail-1.4.7.jar

Evidence

Identifiers

servlet-api-2.5.jar

Evidence

Identifiers

log4j-1.2.17.jar

Evidence

Identifiers

logkit-1.0.1.jar

Evidence

Identifiers

commons-lang3-3.5.jar

Evidence

Identifiers

geronimo-j2ee_1.4_spec-1.1.jar

Evidence

Identifiers

httpclient-4.3.3.jar

Evidence

Identifiers

Published Vulnerabilities

httpcore-4.3.2.jar

Evidence

Identifiers

qpid-client-6.0.0.jar

Evidence

Related Dependencies

Identifiers

slf4j-api-1.7.7.jar

Evidence

Identifiers