BSD Portshttpclient -- Improper Certificate Validation
MITRE reports: Apache Commons HttpClient 3.x, as used in ..., does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Affected versions
- apache-commons-httpclient, jakarta-commons-httpclient >= 3.1
By system
2 still vulnerable, 0 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | java/apache-commons-httpclient | 3.1_3 | vulnerable since 2026-07-10 | |
| MidnightBSD | java/apache-commons-httpclient | 3.1_4 | in range, by version | |
| FreeBSD | java/apache-commons-httpclient | 3.1_7 | vulnerable since 2026-07-10 |