CVE:CVE-2013-7398
CNNVD:CNNVD-201505-251
Async Http Client（又名AHC或async-http-client）是一个允许Java应用程序执行HTTP请求和异步处理该HTTP响应的客户端库。
Async Http Client 1.9.0之前版本的main/java/com/ning/http/client/AsyncHttpClientConfig.java文件中存在安全漏洞，该漏洞源于程序验证X.509证书时没有要求匹配主机名。攻击者可借助任意有效的证书利用该漏洞实施中间人攻击，欺骗HTTPS服务器。
solution:Upgrade async-http-client_project async-http-client to a higher version than *:beta24,and avoid the version *:beta24; Upgrade redhat jboss_fuse to a higher version than 6.1.0,and avoid the version (,6.1.0]