Publish GHSA-2x83-r56g-cv47

advisories/github-reviewed/2018/10/GHSA-2x83-r56g-cv47/GHSA-2x83-r56g-cv47.json

@@ -1,12 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-2x83-r56g-cv47",
-  "modified": "2020-06-16T20:53:18Z",
+  "modified": "2024-03-05T18:49:27Z",
   "published": "2018-10-17T00:05:15Z",
   "aliases": [
     "CVE-2012-6153"
   ],
-  "summary": "High severity vulnerability that affects org.apache.httpcomponents:httpclient",
+  "summary": "Improper certificate validation in org.apache.httpcomponents:httpclient",
   "details": "http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5783.",
   "severity": [
 
@@ -37,6 +37,14 @@
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/apache/httpcomponents-client/commit/6e14fc146a66e0f3eb362f45f95d1a58ee18886a"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/apache/httpcomponents-client/commit/b930227f907af1198765fc47beabbddae344ca7b"
+    },
     {
       "type": "WEB",
       "url": "https://access.redhat.com/solutions/1165533"
@@ -117,10 +125,6 @@
       "type": "WEB",
       "url": "http://svn.apache.org/viewvc?view=revision&revision=1411705"
     },
-    {
-      "type": "WEB",
-      "url": "http://www.securityfocus.com/bid/69257"
-    },
     {
       "type": "WEB",
       "url": "http://www.ubuntu.com/usn/USN-2769-1"