CVE-2015-5262

Aliases:GHSA-fmj5-wv96-r2chDEBIAN-CVE-2015-5262CGA-4hw4-rqqh-hxvpCGA-859m-x93w-wpjgCGA-9v5c-g3x7-gh5jCGA-f5fx-75hf-jcm5CGA-g223-p24x-fmv8CGA-hh2f-7pxw-c2g9CGA-q3wh-qm9j-qmrhCGA-r543-gvfx-vjv3CGA-r87c-64r3-7v24CGA-v4wr-3hhx-q9mrCGA-vh7g-c4h7-wcwcCGA-x6w3-w85j-674cCGA-2wfx-v4w7-q4p2CGA-3v88-688q-5gc6CGA-4xrv-99j2-79wxCGA-72mw-58v4-574gCGA-wvh9-3j8v-75x8CGA-xr4w-83qq-cc4mCGA-224p-mf5w-r7h4CGA-2f24-frqx-9pf8CGA-4w62-6293-7586CGA-583w-322x-c8g8CGA-86f3-9gqm-5vr5CGA-gcmq-m7v6-983wCGA-grm7-886j-w72cCGA-m34v-jhpr-pw9jCGA-vq2r-jhpw-rpcpCGA-wf5p-vh4r-5fv8CGA-3vph-cp6p-969mCGA-6j73-3626-crrjCGA-j9hr-rg8m-5834CGA-xj7m-vr26-67vv
Advisory lineage Upstream: 0 Downstream: 11
Modified
Published: 27 Oct 2015, 16:00
Last modified:06 Aug 2024, 06:41

Vulnerability Summary

Overall Risk (default)
low
21/100
CVSS Score
4.3 MEDIUM
v2.0 (nvd)
EPSS Score
18.76% MEDIUM
19% probability +17.84%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

27 Oct 2015, 16:00
Published
Vulnerability first disclosed
06 Aug 2024, 06:41
Last Modified
Vulnerability information updated

Description

http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.

CVSS Metrics

  • v2.0•MEDIUM•Score: 4.3AV:N/AC:M/Au:N/C:N/I:N/A:P

EPSS Trends

Current EPSS score: 18.76%• Percentile: 97%

Techniques & Countermeasures

  • CWE-399•Resource Management Errors

    Weaknesses in this category are related to improper management of system resources.

Affected Systems

  • apache•httpclient

    ≥ 4.3, ≤ 4.3.5

  • chainguard•eco-java-gradle-1.11

    all

  • chainguard•eco-java-gradle-2.0

    all

  • chainguard•eco-java-gradle-2.1

    all

  • chainguard•eco-java-gradle-2.10

    all

  • chainguard•eco-java-gradle-2.2

    all

  • chainguard•eco-java-gradle-2.2.1

    all

  • chainguard•eco-java-gradle-2.3

    all

  • chainguard•eco-java-gradle-2.4

    all

  • chainguard•eco-java-gradle-2.5

    all

  • chainguard•eco-java-gradle-2.6

    all

  • chainguard•eco-java-gradle-2.7

    all

  • chainguard•eco-java-gradle-2.8

    all

  • chainguard•eco-java-gradle-2.9

    all

  • chainguard•hadoop-fips-3.3.6

    all

  • chainguard•hadoop-fips-3.4.2

    all

  • chainguard•hadoop-fips-3.5

    all

  • canonical•ubuntu_linux

    12.04 | 14.04 | 15.04

  • debian•commons-httpclient

    < 3.1-12 | < 3.1-12 | < 3.1-12 | < 3.1-12

  • debian•httpcomponents-client

    < 4.3.6-1 | < 4.3.6-1 | < 4.3.6-1 | < 4.3.6-1

  • fedoraproject•fedora

    21 | 22 | 23

  • org.apache.httpcomponents•httpclient

    < 4.3.6

References (22)