What’s Vulnerable › Vulnerabilities

CVE-2013-7397

• Severity: medium (CVSS 4.3 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2015-06-24 · updated 2026-06-17
• Weakness: CWE-345

Description

Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, which allows man-in-the-middle attackers to spoof HTTPS servers by presenting an arbitrary certificate during use of a typical AHC configuration, as demonstrated by a configuration that does not send client certificates.

Affected products

• Async-Http-Client Project Async-Http-Client: through 1.9.0
• RedHat Jboss Fuse: through 6.1.0

References

• http://openwall.com/lists/oss-security/2014/08/26/1
• http://rhn.redhat.com/errata/RHSA-2015-0850.html
• http://rhn.redhat.com/errata/RHSA-2015-0851.html
• http://rhn.redhat.com/errata/RHSA-2015-1176.html
• http://rhn.redhat.com/errata/RHSA-2015-1551.html
• http://www.securityfocus.com/bid/69316
• https://github.com/AsyncHttpClient/async-http-client/issues/352
• https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E
• https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E
• https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-06-20
• http://openwall.com/lists/oss-security/2014/08/26/1
• http://rhn.redhat.com/errata/RHSA-2015-0850.html

Get alerted when CVE-2013-7397 or the next vulnerability affects your stack