Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:deb/debian/httpcomponents-client@4.3.5-1?distro=trixie
purl pkg:deb/debian/httpcomponents-client@4.3.5-1?distro=trixie
Vulnerabilities affecting this package (0)
Vulnerability Summary Fixed by
This package is not known to be affected by vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-3bxq-vmjj-kqfe org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field. CVE-2014-3577
GHSA-cfh5-3ghh-wfjx

Date Actor Action Vulnerability Source VulnerableCode Version
2026-05-01T23:25:15.671477+00:00 Debian Importer Fixing VCID-3bxq-vmjj-kqfe https://security-tracker.debian.org/tracker/data/json 38.6.0
2026-04-16T09:21:51.271750+00:00 Debian Importer Fixing VCID-3bxq-vmjj-kqfe https://security-tracker.debian.org/tracker/data/json 38.4.0
2026-04-11T18:15:14.775721+00:00 Debian Importer Fixing VCID-3bxq-vmjj-kqfe https://security-tracker.debian.org/tracker/data/json 38.3.0
2026-04-03T07:26:39.322040+00:00 Debian Importer Fixing VCID-3bxq-vmjj-kqfe https://security-tracker.debian.org/tracker/data/json 38.1.0