GHSA-3cqm-mf7h-prrj

Square OkHttp can accept the wrong certificate

En bref

Publiée: 2022-05-24 17:41 UTC
Mise à jour: 2026-09-10 03:49 UTC
CVE: CVE-2021-0341
Alias: A-171980069, ASB-A-171980069
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11 Android ID: A-171980069

Paquets affectés

Paquet	Versions
Maven · com.squareup.okhttp3:okhttp	introduced 0, fixed 4.9.2

Références

https://nvd.nist.gov/vuln/detail/CVE-2021-0341 ADVISORY
https://github.com/square/okhttp/issues/6724 WEB
https://github.com/square/okhttp/pull/6741 WEB
https://github.com/square/okhttp/commit/f574ea2f5259d9040f264ddeb582fb1ce563f10c WEB
https://github.com/square/okhttp PACKAGE
https://source.android.com/security/bulletin/2021-02-01 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database