OPENSUSE-SU-2020:1875-1: apache-commons-httpclient&distro=openSUSE Leap 15.2 openSUSE

Published

Published 08-11-2020Last modified 04-02-2026

Vulnerability summary

OPENSUSE-SU-2020:1875-1 is a vulnerability in apache-commons-httpclient&distro=openSUSE Leap 15.2 openSUSE with no CVSS score yet.

Priority

Insufficient evidence

No CVSS vector published; no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

Not scored

010

No CVSS score recorded

EPSS scoreNot scoredRisk metrics not yet published.

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 2 · Downstream 0 · Related 2

CVE-2014-3577 CVE-2015-5262

Timeline

08-11-2020
PublishedVulnerability first disclosed.
04-02-2026
Last modifiedVulnerability information updated.

Description

Security update for apache-commons-httpclient This update for apache-commons-httpclient fixes the following issues: - http/conn/ssl/SSLConnectionSocketFactory.java ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors. [bsc#945190, CVE-2015-5262] - org.apache.http.conn.ssl.AbstractVerifier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows MITM attackers to spoof SSL servers via a 'CN=' string in a field in the distinguished name (DN) of a certificate. [bsc#1178171, CVE-2014-3577] This update was imported from the SUSE:SLE-15-SP2:Update update project.