IBM Support

Security Bulletin: Vulnerability in legacy component distributed in IBM Development Package for Apache Spark (CVE-2012-5783)

Security Bulletin


Summary

The Jakarta Commons httpclient version 3.x is known to be vulnerable to SSL spoofing, and is included in the IBM Development Package for Apache Spark, primarily to provide legacy support for Hadoop 2.2. A patch is applied to Jakarta Commons httpclient version 3.1 to fix the vulnerability.

Note: the IBM Development Package for Apache Spark version 1.x provides support for Hadoop 2.6, which does not exercise this vulnerability. The IBM Development Package for Apache Spark version 2.x provides support for Hadoop 2.7.x, which also does not exercise this vulnerability.

Vulnerability Details

CVEID: CVE-2012-5783
DESCRIPTION:
Apache Commons HttpClient, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, could allow a remote attacker to conduct spoofing attacks, caused by the failure to verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate. By persuading a victim to visit a Web site containing a specially-crafted certificate, an attacker could exploit this vulnerability using man-in-the-middle techniques to spoof an SSL server.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/79984 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)

Affected Products and Versions

IBM Development Package for Apache Spark 1.6.2.0 and earlier releases.

Remediation/Fixes

Principal Product and Version(s)

Remediated Component
IBM Development Package for Apache Spark 1.6.2.1 and subsequent releasesPatched Jakarta Commons httpclient 3.1
IBM Development Package for Apache Spark 2.0.0.0 and subsequent releasesPatched Jakarta Commons httpclient 3.1

Workarounds and Mitigations

None. A source code patch for the httpclient 3.1 component exists, but this involves a manual process to apply, re-build and re-package into Apache Spark.

IBM recommends upgrading to a remediated release of the IBM Development Package for Apache Spark.

Get Notified about Future Security Bulletins

References

Off

Change History

9 September 2016 : Original version published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

[{"Product":{"code":"SSAHSS","label":"Development Package for Apache Spark"},"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Component":"--","Platform":[{"code":"PF016","label":"Linux"}],"Version":"1.0","Edition":"","Line of Business":{"code":"","label":""}}]

Document Information

Modified date:
15 June 2018

UID

swg21989192