DEBIAN-CVE-2012-5783

Advisory lineage Upstream: 1 Downstream: 1
Upstream
CVE-2012-5783
Downstream
DLA-222-1
Published: 04 Nov 2012, 22:55
Last modified:28 Apr 2026, 20:12

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

04 Nov 2012, 22:55
Published
Vulnerability first disclosed
28 Apr 2026, 20:12
Last Modified
Vulnerability information updated

Description

Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Affected Systems

  • debian•commons-httpclient

    < 3.1-10.1 | < 3.1-10.1 | < 3.1-10.1 | < 3.1-10.1

References (1)