https://bugzilla.redhat.com/show_bug.cgi?id=1261538
Bug ID: 1261538
Summary: CVE-2015-5262 jakarta-commons-httpclient,
httpcomponents-core: missing HTTPS connection timeout
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: fweimer(a)redhat.com
CC: david(a)gnsa.us, java-maint(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jerboaa(a)gmail.com, krzysztof.daniel(a)gmail.com,
mizdebsk(a)redhat.com, msimacek(a)redhat.com,
msrb(a)redhat.com, pcheung(a)redhat.com
It was discovered that Apache HttpClient did not apply a configured
connection or read timeout during the initial handshake of an HTTPS
connection. As a result, HTTPS connection could get stuck, causing
a denial of service if multiple such connections accumulate.
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=8dau1uPcUr&a=cc_unsubscribe
_______________________________________________
java-sig-commits mailing list
java-sig-commits(a)lists.fedoraproject.org
http://lists.fedoraproject.org/postorius/java-sig-commits@lists.fedorapro...