CVE-2015-5262 Security Details

CVE ID

CVE-2015-5262

CWE

CWE-399

CVE Description

http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.

Published

Mar 28, 2017

CVSS Score & Severity

4.3Medium

CVSS Vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

EPSS Score

4.309%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

org/apache/http/conn/ssl/SSLConnectionSocketFactory.connectSocket(ILjava/net/Socket;Lorg/apache/http/HttpHost;Ljava/net/InetSocketAddress;Ljava/net/InetSocketAddress;Lorg/apache/http/protocol/HttpContext;)Ljava/net/Socket;

JVM

Affected Ecosystems

affected

Source

National Vulnerability Database

References

Apache Jira · HTTPCLIENT-1478PROJECT

tools.cisco.comTHIRD_PARTY