CVE-2013-4366

CriticalCVSS 9.8/10Last modified Jun 16, 2026

Description

http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509HostnameVerifier is not null, which allows attackers to have unspecified impact via vectors involving hostname verification.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://svn.apache.org/r1528614Issue Tracking, Patch, Release Notes, Vendor Advisory
http://www.apache.org/dist/httpcomponents/httpclient/RELEASE_NOTES-4.3.x.txtIssue Tracking, Release Notes, Vendor Advisory
http://svn.apache.org/r1528614Issue Tracking, Patch, Release Notes, Vendor Advisory
http://www.apache.org/dist/httpcomponents/httpclient/RELEASE_NOTES-4.3.x.txtIssue Tracking, Release Notes, Vendor Advisory

Timeline

Published: Oct 30, 2017
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-43677.8ovirt-engine 3.2 running on Linux kernel 3.1 and newer creates certain files world-writeable due to an upstream kernel change which impacted CVE-2013-43681.9The outs instruction emulation in Xen 3.1.x, 4.2.x, 4.3.x, and earlier, when using FS: or GS: segment override, uses an uninitialized variab CVE-2013-43691.9The xlu_vif_parse_rate function in the libxlu library in Xen 4.2.x and 4.3.x allows local users to cause a denial of service (NULL pointer d CVE-2013-43704.6The ocaml binding for the xc_vcpu_getaffinity function in Xen 4.2.x and 4.3.x frees certain memory that may still be intended for use, which CVE-2013-43714.4Use-after-free vulnerability in the libxl_list_cpupool function in the libxl toolstack library in Xen 4.2.x and 4.3.x, when running "under m CVE-2013-43724.3Multiple cross-site scripting (XSS) vulnerabilities in Fuse Management Console in Red Hat JBoss Fuse 6.0.0 before patch 3 and JBoss A-MQ 6.0 CVE-2013-43733.2The storeFiles method in JPADriftServerBean in Red Hat JBoss Operations Network (JON) 3.1.2 allows local users to load arbitrary drift files CVE-2013-43747.1An insecurity temporary file vulnerability exists in RHQ Mongo DB Drift Server through 2013-09-25 when unpacking zipped files.CVE-2013-43752.7The qdisk PV disk backend in qemu-xen in Xen 4.2.x and 4.3.x before 4.3.1, and qemu 1.1 and other versions, allows local HVM guests to cause CVE-2013-43767.5The setgid wrapper libx2go-server-db-sqlite3-wrapper.c in X2Go Server before 4.0.0.2 allows remote attackers to execute arbitrary code via u CVE-2013-43772.3Use-after-free vulnerability in the virtio-pci implementation in Qemu 1.4.0 through 1.6.0 allows local users to cause a denial of service (d CVE-2013-43784.3Cross-site scripting (XSS) vulnerability in HtmlSessionInformationsReport.java in JavaMelody 1.46 and earlier allows remote attackers to inj