Security Bulletin
Summary
The Jakarta Commons httpclient version 3.x is known to be vulnerable to SSL spoofing, and is included in the IBM Development Package for Apache Spark, primarily to provide legacy support for Hadoop 2.2. A patch is applied to Jakarta Commons httpclient version 3.1 to fix the vulnerability.
Note: the IBM Development Package for Apache Spark version 1.x provides support for Hadoop 2.6, which does not exercise this vulnerability. The IBM Development Package for Apache Spark version 2.x provides support for Hadoop 2.7.x, which also does not exercise this vulnerability.
Vulnerability Details
CVEID: CVE-2012-5783
DESCRIPTION: Apache Commons HttpClient, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, could allow a remote attacker to conduct spoofing attacks, caused by the failure to verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate. By persuading a victim to visit a Web site containing a specially-crafted certificate, an attacker could exploit this vulnerability using man-in-the-middle techniques to spoof an SSL server.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/79984 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Affected Products and Versions
IBM Development Package for Apache Spark 1.6.2.0 and earlier releases.
Remediation/Fixes
Principal Product and Version(s) | Remediated Component |
IBM Development Package for Apache Spark 1.6.2.1 and subsequent releases | Patched Jakarta Commons httpclient 3.1 |
IBM Development Package for Apache Spark 2.0.0.0 and subsequent releases | Patched Jakarta Commons httpclient 3.1 |
Workarounds and Mitigations
None. A source code patch for the httpclient 3.1 component exists, but this involves a manual process to apply, re-build and re-package into Apache Spark.
IBM recommends upgrading to a remediated release of the IBM Development Package for Apache Spark.
Get Notified about Future Security Bulletins
References
Change History
9 September 2016 : Original version published
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Was this topic helpful?
Document Information
Modified date:
15 June 2018
UID
swg21989192