Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:deb/debian/commons-httpclient@3.1-11?distro=trixie
purl pkg:deb/debian/commons-httpclient@3.1-11?distro=trixie
Vulnerabilities affecting this package (0)
Vulnerability Summary Fixed by
This package is not known to be affected by vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-3bxq-vmjj-kqfe org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field. CVE-2014-3577
GHSA-cfh5-3ghh-wfjx

Date Actor Action Vulnerability Source VulnerableCode Version
2026-05-01T22:16:59.399217+00:00 Debian Importer Fixing VCID-3bxq-vmjj-kqfe https://security-tracker.debian.org/tracker/data/json 38.6.0
2026-04-16T08:52:13.219183+00:00 Debian Importer Fixing VCID-3bxq-vmjj-kqfe https://security-tracker.debian.org/tracker/data/json 38.4.0
2026-04-11T17:57:21.096902+00:00 Debian Importer Fixing VCID-3bxq-vmjj-kqfe https://security-tracker.debian.org/tracker/data/json 38.3.0
2026-04-02T17:02:58.051135+00:00 Debian Importer Fixing VCID-3bxq-vmjj-kqfe https://security-tracker.debian.org/tracker/data/json 38.1.0