Please see https://bugzilla.redhat.com/show_bug.cgi?id=1259892

Cheers,
 -- Guido

Le 11/09/2015 15:12, Guido Günther a écrit :

Thank you for the report Guido. A hanging connection is certainly
annoying but I fail to understand why it's flagged as a security
vulnerability.

Note that according to HTTPCLIENT-1478 [1] this was completely fixed in
the version 4.3.6. So if this is really a security issue the
httpcomponents-client package in stable and oldstable is also affected.

[1] https://issues.apache.org/jira/browse/HTTPCLIENT-1478

Hi,

Since a malicious server can starve client connections _although_ the
client took countermeasures to prevent this (by setting a timeout).

I do think so but I haven't checked yet and

https://bugzilla.redhat.com/show_bug.cgi?id=1261538

as well as

https://issues.apache.org/jira/browse/HTTPCLIENT-1478?focusedCommentId=13926162&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-13926162

claim that it's not yet reproduced for httpcomponents-client 4.2.x
that's why I didn't file a but for httpcomponents-client yet until
this is investigated further.

Cheers,
 -- Guido

(this is not about commons-httpclient but about httpcomponents-client)
[...]

I did look into the source code and it looks like that this was a
regression in 4.3.x. So only jessie is affected. squeeze, wheezy (and
likely sid) seem to be fine.

Coming back to commons-httpclient:

RedHat produced a patch here:
https://bugzilla.redhat.com/attachment.cgi?id=1072467&action=diff
Part of https://bugzilla.redhat.com/show_bug.cgi?id=1259892

BTW, would it not be possible to get rid of commons-httpclient
if it has been obsoleted by httpcomponents-client ?

Cheers,

We believe that the bug you reported is fixed in the latest version of
commons-httpclient, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 798650@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Mike Gabriel <sunweaver@debian.org> (supplier of updated commons-httpclient package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Wed, 30 Sep 2015 16:10:18 +0200
Source: commons-httpclient
Binary: libcommons-httpclient-java libcommons-httpclient-java-doc
Architecture: source all
Version: 3.1-9+deb6u2
Distribution: squeeze-lts
Urgency: medium
Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
Changed-By: Mike Gabriel <sunweaver@debian.org>
Description:
 libcommons-httpclient-java - A Java(TM) library for creating HTTP clients
 libcommons-httpclient-java-doc - Documentation for libcommons-httpclient-java
Closes: 798650
Changes:
 commons-httpclient (3.1-9+deb6u2) squeeze-lts; urgency=medium
 .
   * Non-maintainer upload by the Debian LTS Team.
   * debian/patches:
     + CVE-2015-5262.patch. Respect configured SO_TIMEOUT during SSL handshake.
       (CVE-2015-5262). (Closes: #798650).
Checksums-Sha1:
 c17f62809423ae857db62a14a6c50be4cb5ddef6 2433 commons-httpclient_3.1-9+deb6u2.dsc
 6aa4a05e47d5b953196e38ed60396ba3c21be6d8 13340 commons-httpclient_3.1-9+deb6u2.diff.gz
 aeacbe1f03aa60dec7119844d0aea8322d29be50 299660 libcommons-httpclient-java_3.1-9+deb6u2_all.deb
 6f86b61b348fe41fade11b8c726ee1b30163c135 1548082 libcommons-httpclient-java-doc_3.1-9+deb6u2_all.deb
Checksums-Sha256:
 6cfdc1b50cc92a6cdf28851b6787013f7fc98fee933462f92f91c9e4da5694dc 2433 commons-httpclient_3.1-9+deb6u2.dsc
 d9761a0a93cf117a4986f5d2553364eb55d9e78ca11147e2da5fb86be571536c 13340 commons-httpclient_3.1-9+deb6u2.diff.gz
 2dc95b882c3d7784a5ed4ccecdc78a80ae3fcee0969f88f077a6ffdf932a2ea5 299660 libcommons-httpclient-java_3.1-9+deb6u2_all.deb
 078bae7d2c0b4ee0016330a9200890f1a75bda6c797f45858a2a34260773fdd7 1548082 libcommons-httpclient-java-doc_3.1-9+deb6u2_all.deb
Files:
 cae20482aacfa17a4beb089492a4427f 2433 java optional commons-httpclient_3.1-9+deb6u2.dsc
 2a0b3f191dd4a211a1b97fdcc2575751 13340 java optional commons-httpclient_3.1-9+deb6u2.diff.gz
 348dec40ce6d4a1ae66dbed9c19bea7a 299660 java optional libcommons-httpclient-java_3.1-9+deb6u2_all.deb
 1f5b21892a3ab06bf2eb5c82c75e7e73 1548082 doc optional libcommons-httpclient-java-doc_3.1-9+deb6u2_all.deb
iQIcBAEBCAAGBQJWC/EAAAoJEJr0azAldxsxtesP/0JnEkU+OHgLLb+GFlq2a0lw
K7jaNNdfkU7KCbyDbGF5ELf5dfevOso6xjuHRQ/VkuiBnzXdC+HJ5bJAa43Mm21L
TgF/HOJ/TgmYIfJ0+nJ8kx6MzSujJYSM7gPF9PBivCaha+6dXBqRds2sEytGVaa7
Lv9nH9UMGFJIvaouO/o2rOHiNcojlBzS4lW80Q9VjqKfpYjNHzsWPEpcTe39eiNc
UKeyIkIL+uBaMNDCBLa/WgGu7pjTT/piSZNbuBd2IKlqb7eLTgmBfY8gUYQCoJtx
RX3XqbLiv9n+JpYpUEEtx8uwuen3ZnGGGUXIfu82nmC22a+sWAiNJ+NJ6VBYv4ai
Xb2Roc7QIhuRr1hF4lSnLSuresPCUQn8GvGlUDkMOcLq5cbbvU/H4Y56hx8v8F44
EZrzfcJo2Fpjy+fx9PSLw9I92thazUelaFO82E72YdKZx6phb0u07r3NcJpAxNJ2
mCRqTBsniO9gMMmcOyKix92c3CwuBwntbg1np3PDCJJVUCiSmww0hko1gfEsHZx2
noLTXARE5XPmcr3/C3MJQVrDoXfW9BkjXN+hmSTMoTLBX+hVe/Wvq5ERkF5n8S20
VHDsO16U2JvMajzAsp4OCN2AcuQknFwBWoKjwtn4vcoMw5LlQb9SwTadtPvrm0eq
gnev/jOhImY+9GucoLh3
=2waL
-----END PGP SIGNATURE-----

reopen 798650
notfixed 798650 3.1-10.2+deb7u1
notfixed 798650 3.1-11
clone 798650 -1
reassign -1 src:httpcomponents-client
found -1 4.0.1-1squeeze1
notfound -1 4.4.1-1
thanks

Hi,

this bug is still not fixed in oldstable, stable, testing and unstable.
Moreover it is also present in httpcomponents-client in oldstable and
stable but was fixed in testing and unstable.

According to https://issues.apache.org/jira/browse/HTTPCLIENT-1478
this issue was fixed in httpcomponents-client >= 4.3.6.

Reopening

Markus