CVE-2013-7397

Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location…

published June 24, 2015

CVSS
—
EPSS
1%
Percentile
62.2
In the wild
Unconfirmed
What it is

Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, which allows man-in-the-middle attackers to spoof HTTPS servers by presenting an arbitrary certificate during use of a typical AHC configuration, as demonstrated by a configuration that does not send client certificates.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00993 · 62.2th percentile
Published
2015-06-24T16:00Z
EPSS history
Timeline
  • 24 JUN 16:00Z
    Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location…
    cvelistv5