CVE-2016-2402 Improper Certificate Validation in OkHttp
MediumCVSS 5.9
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
OkHttp before 2.7.4 and 3.x before 3.1.2 allows man-in-the-middle attackers to bypass certificate pinning by sending a certificate chain with a certificate from a non-pinned trusted CA and the pinned certificate.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| com.squareup.okhttp3/okhttp(Maven) | <= 2.7.3 | No fix listed |
| com.squareup.okhttp3/okhttp(Maven) | >= 3.0.0, <= 3.1.1 | No fix listed |
| com.squareup.okhttp3/okhttp(Maven) | < 2.7.4 | 2.7.4 |
| com.squareup.okhttp3/okhttp(Maven) | >= 3.0.0, < 3.1.2 | 3.1.2 |
| com.squareup.okhttp3/okhttp(Maven) | = 3.0.0 | No fix listed |
| com.squareup.okhttp3/okhttp(Maven) | = 3.0.1 | No fix listed |
| com.squareup.okhttp3/okhttp(Maven) | = 3.1.0 | No fix listed |
| com.squareup.okhttp3/okhttp(Maven) | = 3.1.1 | No fix listed |
| squareup okhttp | <= 2.7.3 | No fix listed |
| squareup okhttp3 | = 3.0.0 | No fix listed |
| squareup okhttp3 | = 3.0.0-rc1 | No fix listed |
| squareup okhttp3 | = 3.0.1 | No fix listed |
| squareup okhttp3 | = 3.1.0 | No fix listed |
| squareup okhttp3 | = 3.1.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- koz.io technical-description third-party-advisory
- lists.apache.org
- publicobject.com vendor-advisory
- [oss-security] 20160210 CVE request - OkHttp Certificate Pining Bypass mailing-list third-party-advisory
- [oss-security] 20160217 Re: CVE request - OkHttp Certificate Pining Bypass mailing-list third-party-advisory
- github.com
- github.com product
- [pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list mailing-list