CVE-2015-5262

Severity

43%

Complexity

86%

Confidentiality

48%

http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.

http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.

CVSS 2.0 Base Score 4.3. CVSS Attack Vector: network. CVSS Attack Complexity: medium. CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P).

Overview

First reported 9 years ago

2015-10-27 16:59:00

Last updated 6 years ago

2018-07-19 01:29:00

Affected Software

Canonical Ubuntu Linux 12.04 LTS

12.04

Canonical Ubuntu Linux 14.04 LTS (Long-Term Support)

14.04

Canonical Ubuntu Linux 15.04

15.04

Fedora 21

21

Fedora 22

22

Fedora Project Fedora 23

23

References

FEDORA-2015-15590

Third Party Advisory

FEDORA-2015-15589

Third Party Advisory

FEDORA-2015-15588

Third Party Advisory

http://svn.apache.org/viewvc?view=revision&revision=1626784

Vendor Advisory

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

1033743

Third Party Advisory, VDB Entry

USN-2769-1

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1261538

Issue Tracking, Third Party Advisory

https://issues.apache.org/jira/browse/HTTPCLIENT-1478

Vendor Advisory

https://jenkins.io/security/advisory/2018-02-26/

Third Party Advisory

[drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities

[drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.