CVE-2015-5262
NoneCVSS
—
EPSS
18.8%
Published
Oct 27, 2015
CISA due date
—
The record
http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.apache.httpcomponents:httpclient | 0 | 4.3.6 |
| Debian:10 | httpcomponents-client | 0 | 4.3.6-1 |
| Debian:11 | commons-httpclient | 0 | 3.1-12 |
| Debian:11 | httpcomponents-client | 0 | 4.3.6-1 |
| Debian:12 | commons-httpclient | 0 | 3.1-12 |
| Debian:12 | httpcomponents-client | 0 | 4.3.6-1 |
| Debian:13 | commons-httpclient | 0 | 3.1-12 |
| Debian:13 | httpcomponents-client | 0 | 4.3.6-1 |
| Debian:6.0 | commons-httpclient | 0 | 3.1-9+deb6u2 |
| Mageia:5 | httpcomponents-client | 0 | 4.3.6-1.mga5 |
| Mageia:5 | jakarta-commons-httpclient | 0 | 3.1-15.1.mga5 |
| SUSE:Enterprise Storage 5 | apache-commons-httpclient | 0 | 3.1-6.3.1 |
| SUSE:HPE Helion OpenStack 8 | apache-commons-httpclient | 0 | 3.1-6.3.1 |
| SUSE:Linux Enterprise High Performance Computing 15-ESPOS | apache-commons-httpclient | 0 | 3.1-4.3.2 |
| SUSE:Linux Enterprise High Performance Computing 15-LTSS | apache-commons-httpclient | 0 | 3.1-4.3.2 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP1 | apache-commons-httpclient | 0 | 3.1-4.3.2 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP2 | apache-commons-httpclient | 0 | 3.1-11.3.2 |
| SUSE:Linux Enterprise Server 12 SP2-BCL | apache-commons-httpclient | 0 | 3.1-6.3.1 |
| SUSE:Linux Enterprise Server 12 SP2-LTSS | apache-commons-httpclient | 0 | 3.1-6.3.1 |
| SUSE:Linux Enterprise Server 12 SP3-BCL | apache-commons-httpclient | 0 | 3.1-6.3.1 |
| SUSE:Linux Enterprise Server 12 SP3-LTSS | apache-commons-httpclient | 0 | 3.1-6.3.1 |
| SUSE:Linux Enterprise Server 12 SP4-LTSS | apache-commons-httpclient | 0 | 3.1-6.3.1 |
| SUSE:Linux Enterprise Server 12 SP5 | apache-commons-httpclient | 0 | 3.1-6.3.1 |
| SUSE:Linux Enterprise Server 15-LTSS | apache-commons-httpclient | 0 | 3.1-4.3.2 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP2 | apache-commons-httpclient | 0 | 3.1-6.3.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | apache-commons-httpclient | 0 | 3.1-6.3.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | apache-commons-httpclient | 0 | 3.1-6.3.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | apache-commons-httpclient | 0 | 3.1-6.3.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 | apache-commons-httpclient | 0 | 3.1-4.3.2 |
| SUSE:OpenStack Cloud 7 | apache-commons-httpclient | 0 | 3.1-6.3.1 |
| SUSE:OpenStack Cloud 8 | apache-commons-httpclient | 0 | 3.1-6.3.1 |
| SUSE:OpenStack Cloud 9 | apache-commons-httpclient | 0 | 3.1-6.3.1 |
| SUSE:OpenStack Cloud Crowbar 8 | apache-commons-httpclient | 0 | 3.1-6.3.1 |
| SUSE:OpenStack Cloud Crowbar 9 | apache-commons-httpclient | 0 | 3.1-6.3.1 |
| Ubuntu:14.04:LTS | commons-httpclient | 0 | 3.1-10.2ubuntu0.14.04.1 |
| Ubuntu:16.04:LTS | commons-httpclient | 0 | 3.1-11ubuntu1 |
| Ubuntu:16.04:LTS | httpcomponents-client | 0 | 4.4.1-1 |
| Ubuntu:Pro:14.04:LTS | httpcomponents-client | 0 | 4.3.3-1ubuntu0.1+esm1 |
| openSUSE:Leap 15.1 | apache-commons-httpclient | 0 | 3.1-lp151.4.3.1 |
| openSUSE:Leap 15.2 | apache-commons-httpclient | 0 | 3.1-lp152.6.3.1 |
| openSUSE:Tumbleweed | apache-commons-httpclient | 0 | 3.1-13.4 |
Related vulnerabilities
- CVE-2012-5783 Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant… Also affects commons-httpclient
- CVE-2026-41983 Null pointer dereference vulnerability in the browser module. Impact: Successful… CWE-399
- CVE-2015-9252 An issue was discovered in QPDF before 7.0.0. CWE-399
- CVE-2012-0881 Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of… CWE-399
- CVE-2015-7944 The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x… CWE-399
- CVE-2015-8855 The semver package before 4.3.2 for Node.js allows attackers to cause a denial of service… CWE-399
- CVE-2015-8858 The uglify-js package before 2.6.0 for Node.js allows attackers to cause a denial of… CWE-399
- CVE-2016-9312 ntpd in NTP before 4.2.8p9, when running on Windows, allows remote attackers to cause a… CWE-399