CVE-2013-4366

Critical

Published: 30/10/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

In Apache HttpClient versions 4.3.x before 4.3.1, it does not ensure that X509HostnameVerifier is not null, which may allow attackers to exploit vulnerabilities involving hostname verification.

Risk Assessment

The lack of proper hostname verification may lead to man-in-the-middle attacks, jeopardizing the integrity and confidentiality of data transmitted by the application.

Recommendation

It is recommended to upgrade Apache HttpClient to version 4.3.1 or later to ensure proper hostname verification.

Original NVD description (English source)

http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509HostnameVerifier is not null, which allows attackers to have unspecified impact via vectors involving hostname verification.