CVE-2012-5781: Amazon Elastic Load Balancing

Medium severity, CVSS 5.8. EPSS: 0.7% chance of exploitation in the next 30 days.

Amazon Elastic Load Balancing API Tools does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to overriding the default JDK X509TrustManager.

Affected products

• Amazon Elastic Load Balancing: affected versions not specified; version 1.0 only; version 1.0.3.4 only; version 1.0.9.3 only; version 1.0.10.0 only; version 1.0.11.1 only; …

Published 2012-11-04. Last modified 2026-06-16.