From 62f8adeba625afe6060acfeb7bc5d84a0b2a1c9b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 13 Aug 2026 19:04:51 +0000 Subject: [PATCH 1/3] Bump org.apache.httpcomponents.client5:httpclient5 in /parent Bumps [org.apache.httpcomponents.client5:httpclient5](https://github.com/apache/httpcomponents-client) from 5.6.2 to 5.6.3. - [Changelog](https://github.com/apache/httpcomponents-client/blob/rel/v5.6.3/RELEASE_NOTES.txt) - [Commits](https://github.com/apache/httpcomponents-client/compare/rel/v5.6.2...rel/v5.6.3) --- updated-dependencies: - dependency-name: org.apache.httpcomponents.client5:httpclient5 dependency-version: 5.6.3 dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- parent/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/parent/pom.xml b/parent/pom.xml index bea01ea7804..fe239f4d127 100644 --- a/parent/pom.xml +++ b/parent/pom.xml @@ -132,7 +132,7 @@ 4.5.14 [4.3,4.5.0) 4.4.16 - 5.6.2 + 5.6.3 5.4.3 3.2.1 3.2.1 From cfe22d2b1f29ba1db8941b8ed252a38320bf461e Mon Sep 17 00:00:00 2001 From: Andriy Redko Date: Thu, 13 Aug 2026 15:58:42 -0400 Subject: [PATCH 2/3] Apply suggestion from @reta --- parent/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/parent/pom.xml b/parent/pom.xml index fe239f4d127..01bbcbf1c88 100644 --- a/parent/pom.xml +++ b/parent/pom.xml @@ -132,7 +132,7 @@ 4.5.14 [4.3,4.5.0) 4.4.16 - 5.6.3 + 5.6.4 5.4.3 3.2.1 3.2.1 From 2b5a638f9d04d7d01b66bcc76e127056aecd166c Mon Sep 17 00:00:00 2001 From: Andriy Redko Date: Fri, 14 Aug 2026 11:42:49 -0400 Subject: [PATCH 3/3] Fix AbstractApacheClientServerHttp2Test / AbstractUndertowClientServerHttp2Test test cases --- .../asyncclient/hc5/AsyncHTTPConduit.java | 3 +- .../hc5/URLConnectionAsyncHTTPConduit.java | 3 +- .../transport/https/InsecureTrustManager.java | 43 +++++++++++++++++++ .../AbstractApacheClientServerHttp2Test.java | 2 +- .../hc5/https/clientauth/ClientAuthTest.java | 2 +- .../hc5/https/trust/TrustManagerTest.java | 2 +- .../https/trust/client-trust-manager-ref.xml | 2 +- ...AbstractUndertowClientServerHttp2Test.java | 2 +- 8 files changed, 52 insertions(+), 7 deletions(-) diff --git a/rt/transports/http-hc5/src/main/java/org/apache/cxf/transport/http/asyncclient/hc5/AsyncHTTPConduit.java b/rt/transports/http-hc5/src/main/java/org/apache/cxf/transport/http/asyncclient/hc5/AsyncHTTPConduit.java index 2d280edf8ba..382425e6a45 100644 --- a/rt/transports/http-hc5/src/main/java/org/apache/cxf/transport/http/asyncclient/hc5/AsyncHTTPConduit.java +++ b/rt/transports/http-hc5/src/main/java/org/apache/cxf/transport/http/asyncclient/hc5/AsyncHTTPConduit.java @@ -83,6 +83,7 @@ import org.apache.hc.client5.http.impl.auth.BasicScheme; import org.apache.hc.client5.http.protocol.HttpClientContext; import org.apache.hc.client5.http.ssl.DefaultClientTlsStrategy; +import org.apache.hc.client5.http.ssl.HostnameVerificationPolicy; import org.apache.hc.core5.concurrent.BasicFuture; import org.apache.hc.core5.concurrent.FutureCallback; import org.apache.hc.core5.http.Header; @@ -591,7 +592,7 @@ public Credentials getCredentials(final AuthScope authscope, HttpContext context sslContext.getSupportedSSLParameters().getProtocols()); tlsStrategy = new DefaultClientTlsStrategy(sslcontext, protocols, - cipherSuites, SSLBufferMode.STATIC, verifier); + cipherSuites, SSLBufferMode.STATIC, HostnameVerificationPolicy.CLIENT, verifier); } catch (final GeneralSecurityException e) { LOG.warning(e.getMessage()); } diff --git a/rt/transports/http-hc5/src/main/java/org/apache/cxf/transport/http/asyncclient/hc5/URLConnectionAsyncHTTPConduit.java b/rt/transports/http-hc5/src/main/java/org/apache/cxf/transport/http/asyncclient/hc5/URLConnectionAsyncHTTPConduit.java index 900c778adad..d81240d5325 100644 --- a/rt/transports/http-hc5/src/main/java/org/apache/cxf/transport/http/asyncclient/hc5/URLConnectionAsyncHTTPConduit.java +++ b/rt/transports/http-hc5/src/main/java/org/apache/cxf/transport/http/asyncclient/hc5/URLConnectionAsyncHTTPConduit.java @@ -78,6 +78,7 @@ import org.apache.hc.client5.http.impl.auth.BasicCredentialsProvider; import org.apache.hc.client5.http.protocol.HttpClientContext; import org.apache.hc.client5.http.ssl.DefaultClientTlsStrategy; +import org.apache.hc.client5.http.ssl.HostnameVerificationPolicy; import org.apache.hc.core5.concurrent.BasicFuture; import org.apache.hc.core5.concurrent.FutureCallback; import org.apache.hc.core5.http.Header; @@ -584,7 +585,7 @@ public Credentials getCredentials(final AuthScope authscope, HttpContext context sslContext.getSupportedSSLParameters().getProtocols()); tlsStrategy = new DefaultClientTlsStrategy(sslcontext, protocols, - cipherSuites, SSLBufferMode.STATIC, verifier); + cipherSuites, SSLBufferMode.STATIC, HostnameVerificationPolicy.CLIENT, verifier); } catch (final GeneralSecurityException e) { LOG.warning(e.getMessage()); } diff --git a/rt/transports/http/src/main/java/org/apache/cxf/transport/https/InsecureTrustManager.java b/rt/transports/http/src/main/java/org/apache/cxf/transport/https/InsecureTrustManager.java index e09755c19ef..6a7963fe2ca 100644 --- a/rt/transports/http/src/main/java/org/apache/cxf/transport/https/InsecureTrustManager.java +++ b/rt/transports/http/src/main/java/org/apache/cxf/transport/https/InsecureTrustManager.java @@ -19,11 +19,14 @@ package org.apache.cxf.transport.https; +import java.net.Socket; import java.security.cert.CertificateException; import java.security.cert.X509Certificate; import java.util.logging.Logger; +import javax.net.ssl.SSLEngine; import javax.net.ssl.TrustManager; +import javax.net.ssl.X509ExtendedTrustManager; import javax.net.ssl.X509TrustManager; import org.apache.cxf.common.logging.LogUtils; @@ -45,6 +48,11 @@ public static TrustManager[] getNoOpX509TrustManagers() { return new TrustManager[] {new NoOpX509TrustManager()}; } + public static TrustManager[] getNoOpX509ExtendedTrustManagers() { + LOG.warning("This class essentially disables TLS trust verification and is insecure!"); + return new TrustManager[] {new NoOpX509ExtendedTrustManager()}; + } + private static final class NoOpX509TrustManager implements X509TrustManager { private NoOpX509TrustManager() { @@ -65,4 +73,39 @@ public X509Certificate[] getAcceptedIssuers() { } } + + private static final class NoOpX509ExtendedTrustManager extends X509ExtendedTrustManager { + @Override + public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException { + } + + @Override + public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException { + } + + @Override + public X509Certificate[] getAcceptedIssuers() { + return null; + } + + @Override + public void checkClientTrusted(X509Certificate[] chain, String authType, Socket socket) + throws CertificateException { + } + + @Override + public void checkServerTrusted(X509Certificate[] chain, String authType, Socket socket) + throws CertificateException { + } + + @Override + public void checkClientTrusted(X509Certificate[] chain, String authType, SSLEngine engine) + throws CertificateException { + } + + @Override + public void checkServerTrusted(X509Certificate[] chain, String authType, SSLEngine engine) + throws CertificateException { + } + } } diff --git a/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/http2/AbstractApacheClientServerHttp2Test.java b/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/http2/AbstractApacheClientServerHttp2Test.java index b93efc56b0b..768250babc2 100644 --- a/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/http2/AbstractApacheClientServerHttp2Test.java +++ b/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/http2/AbstractApacheClientServerHttp2Test.java @@ -170,7 +170,7 @@ private WebClient createWebClient(final String path, final boolean enableHttp2) } // Create TrustManager instance which trusts all clients and servers - params.setTrustManagers(InsecureTrustManager.getNoOpX509TrustManagers()); + params.setTrustManagers(InsecureTrustManager.getNoOpX509ExtendedTrustManagers()); params.setDisableCNCheck(true); } diff --git a/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/clientauth/ClientAuthTest.java b/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/clientauth/ClientAuthTest.java index 3c51d83b16b..5bb02bda4e6 100644 --- a/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/clientauth/ClientAuthTest.java +++ b/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/clientauth/ClientAuthTest.java @@ -408,7 +408,7 @@ public void testCheckKeyManagersWithCertAlias() throws Exception { assertNotNull("Service is null", service); // Set up (shared) KeyManagers/TrustManagers - TrustManager[] trustManagers = InsecureTrustManager.getNoOpX509TrustManagers(); + TrustManager[] trustManagers = InsecureTrustManager.getNoOpX509ExtendedTrustManagers(); KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm()); diff --git a/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/trust/TrustManagerTest.java b/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/trust/TrustManagerTest.java index 9898ed2c94c..82a9ae36bda 100644 --- a/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/trust/TrustManagerTest.java +++ b/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/trust/TrustManagerTest.java @@ -125,7 +125,7 @@ public void testNoOpX509TrustManager() throws Exception { } TLSClientParameters tlsParams = new TLSClientParameters(); - tlsParams.setTrustManagers(InsecureTrustManager.getNoOpX509TrustManagers()); + tlsParams.setTrustManagers(InsecureTrustManager.getNoOpX509ExtendedTrustManagers()); tlsParams.setDisableCNCheck(true); Client client = ClientProxy.getClient(port); diff --git a/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/trust/client-trust-manager-ref.xml b/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/trust/client-trust-manager-ref.xml index 474245dd328..3aaef1085de 100644 --- a/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/trust/client-trust-manager-ref.xml +++ b/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/trust/client-trust-manager-ref.xml @@ -31,7 +31,7 @@ - + diff --git a/systests/transport-undertow/src/test/java/org/apache/cxf/systest/http_undertow/http2/AbstractUndertowClientServerHttp2Test.java b/systests/transport-undertow/src/test/java/org/apache/cxf/systest/http_undertow/http2/AbstractUndertowClientServerHttp2Test.java index faac3e1d231..d7717b0c849 100644 --- a/systests/transport-undertow/src/test/java/org/apache/cxf/systest/http_undertow/http2/AbstractUndertowClientServerHttp2Test.java +++ b/systests/transport-undertow/src/test/java/org/apache/cxf/systest/http_undertow/http2/AbstractUndertowClientServerHttp2Test.java @@ -117,7 +117,7 @@ private WebClient createWebClient(final String path, final boolean enableHttp2) } // Create TrustManager instance which trusts all clients and servers - params.setTrustManagers(InsecureTrustManager.getNoOpX509TrustManagers()); + params.setTrustManagers(InsecureTrustManager.getNoOpX509ExtendedTrustManagers()); params.setDisableCNCheck(true); }