7.5Yüksek
CVE-2025-27820Apache HttpComponents: PSL (Public Suffix List) validation bypass
Açıklama
A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the Apache HttpClient team. Fixed in the 5.4.3 release
Zayıflık türü (CWE):
CWE-295
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| Apache Software Foundation | Apache HttpComponents | 5.4.0 – < 5.4.3 | |
| apache | httpclient | 5.4 – < 5.4.3 | |
| netapp | ontap tools | 10 |
Kaynaklar ve yamalar
- https://github.com/apache/httpcomponents-client/pull/574 patchIssue TrackingPatch
- https://github.com/apache/httpcomponents-client/pull/621 patchIssue TrackingPatch
- https://hc.apache.org/httpcomponents-client-5.4.x/index.html productProduct
- https://lists.apache.org/thread/55xhs40ncqv97qvoocok44995xp5kqn8 vendor-advisoryMailing ListPatch
- https://security.netapp.com/advisory/ntap-20250516-0003/ Third Party Advisory
CPE eşleşmeleri (NVD) (2)
cpe:2.3:a:apache:httpclient:*:*:*:*:*:*:*:*≥ 5.4 < 5.4.3cpe:2.3:a:netapp:ontap_tools:10:*:*:*:*:vmware_vsphere:*:*