CVE-2012-5785¶

WSO2 Products impacted: no

Customer action required: no

REPORTED VULNERABILITY¶

Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.¹

REPORTED PRODUCTS¶

• WSO2 Identity Server : 7.2.0, 7.3.0

WSO2 JUSTIFICATION¶

Apache Axis2 is used in WSO2 Identity Server as the core SOAP/Web Services engine, handling service deployment, message routing and transport management. The product ships a WSO2-maintained fork of Axis2 rather than the upstream 1.6.1 release.²

The defect described in this CVE lives in CommonsHTTPTransportSender, which built HTTPS connections through Apache Commons HttpClient 3.x without verifying the server hostname against the certificate's CN or subjectAltName. That code path is not exercised in WSO2 Identity Server:

Admin service calls do not traverse the network. The ServerURL in carbon.xml is configured as local:/${carbon.context}/services/, which routes all admin service invocations through the in-JVM local transport (CarbonLocalTransportSender) rather than an HTTP transport sender. CommonsHTTPTransportSender is therefore never invoked for these calls.³⁴

Outbound HTTPS uses a modern, hostname-verifying client. All outbound HTTPS connections to external endpoints are made through the WSO2 HTTP client utilities, which are built on Apache HttpClient 5 with hostname verification enabled.⁵⁶

In addition, no component in the product outside the Axis2 bundle itself references CommonsHTTPTransportSender.

Based on this evidence, we conclude that this vulnerability does not pose a security risk to the impacted versions of WSO2 products listed above.

REFERENCES¶