CVE-2012-6153¶
WSO2 Products impacted: no
Customer action required: no
REPORTED VULNERABILITY¶
Apache Commons HttpClient does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate. A man-in-the-middle attacker could spoof an SSL server by presenting a certificate whose subject contains a common name in a field other than the CN field. This issue exists because of an incomplete fix for CVE-2012-5783.1
REPORTED PRODUCTS¶
- WSO2 Identity Server : 7.3.0
WSO2 JUSTIFICATION¶
WSO2 Identity Server ships with a WSO2-maintained fork of Apache Commons HttpClient (commons-httpclient_3.1.0.wso2v6.jar) instead of the upstream 3.1 release. This fork is the only bundle in the product that provides the org.apache.commons.httpclient packages at runtime.
The fork implements SSL server hostname verification in SSLProtocolSocketFactory. Hostname extraction from the server certificate has been hardened to address the incomplete fix described in CVE-2012-6153. Instead of searching the subject string for the text CN=, the fork parses the certificate's subject distinguished name as a structured X.500 name. It takes the hostname only from a genuine CN attribute and validates it together with the DNS subjectAltName entries. As a result, a CN-like value embedded in another subject field (for example, in the Organization or Organizational Unit field) is not treated as the certificate's hostname. This fix is available from commons-httpclient_3.1.0.wso2v3 onwards.23
Therefore, commons-httpclient_3.1.0.wso2v3 and all subsequent versions of the WSO2-maintained fork are not affected by this vulnerability.
CONCLUSION¶
- WSO2 products use a WSO2-maintained fork of Apache Commons HttpClient. In this fork, the server hostname is taken only from a genuine CN attribute of the certificate's subject DN and is validated against the subjectAltName entries.
Therefore, WSO2 concludes that this vulnerability is already mitigated in the aforementioned WSO2 products, and a dependency upgrade will not be carried out solely based on the detection of CVE-2012-6153.