CVE-2013-7398

Description

main/java/com/ning/http/client/AsyncHttpClientConfig.java in Async Http Client (aka AHC or async-http-client) before 1.9.0 does not require a hostname match during verification of X.509 certificates, which allows man-in-the-middle attackers to spoof HTTPS servers via an arbitrary valid certificate.

Risk Information

Base Score

8.6

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C

EPSS Score

Exploitation Probability

1.231

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2013-7398,CVE-2013-7397 are fixed in Ning-async-http-client 1.9.0	Windows
Vulnerabilities CVE-2013-7398,CVE-2013-7397 are fixed in Ning-async-http-client for Linux 1.9.0	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234