okhttp: information disclosure via improperly used cryptographic function

In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Produc...

Streams: component version with information disclosure flaw

A flaw was found in Red Hat's AMQ-Streams, which ships a version of the OKHttp component with an information disclosure flaw via an exception triggered by a header containing an illegal value. This issue could allow an authenticated attacker to access information outside of their regular...

CVE-2023-0833

A flaw was found in Red Hat's AMQ-Streams, which ships a version of the OKHttp component with an information disclosure flaw via an exception triggered by a header containing an illegal value. This issue could allow an authenticated attacker to access information outside of their regular...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.9 XP 4.0.0.GA Security release

JBoss EAP XP 4.0.0.GA Security release on the EAP 7.4.9 base. See references for release notes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Security Bulletin: IBM Planning Analytics Workspace is affected by multiple vulnerabilities (CVE-2021-40690, CVE-2022-25647, XFID: 233967)

Summary IBM Planning Analytics Workspace is affected by multiple vulnerabilities. Apache Santuario Security for Java provides a mechanism for XML-Signature & XML Encryption syntax and processing CVE-2021-40690. Google Gson is an open-source Java library to serialize and deserialize Java objects t...

OKHttp Square Authentication Bypass Man-in-the-Middle

The vulnerability of the client’s HTTP library, OKHttp Square, is related to errors in the certificate authentication process. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions and execute a type of “man-in-the-middle” attack...

ai.h2o:sparkling-water-core_2.11 (>=3.32.0.1-2-2.1, <=3.36.0.2-1-2.4), ai.h2o:sparkling-water-core_2.12 (>=3.32.0.1-2-3.0, <=3.36.0.2-1-3.0) +421 more potentially affected by CVE-2021-0341 via com.squareup.okhttp3:okhttp (3.12.6)

com.squareup.okhttp3:okhttp MAVEN version 3.12.6 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.okhttp3:okhttp and may be impacted: - ai.h2o:sparkling-water-core2.11 =3.32.0.1-2-2.1, =3.32.0.1-2-3.0, =3.34.0.3-1-2.2, =3.34.0.3-1-3.0,...

ca.uhn.hapi.fhir:hapi-fhir-android (>=2.1, <=2.5), ca.uhn.hapi.fhir:hapi-fhir-client-okhttp (>=2.0, <=2.5) +411 more potentially affected by CVE-2021-0341 via com.squareup.okhttp3:okhttp (3.4.1)

com.squareup.okhttp3:okhttp MAVEN version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.okhttp3:okhttp and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-android =2.1, =2.0, =2.0.5, =2.2.0, =2.0.8, =0.0.1, =0.0.4, =0.0.4, =0.0.4,...

ai.cochl:sense-api (v0.0.1), ai.h2o:h2o-bindings (>=3.30.0.4, <=3.46.0.12) +4781 more potentially affected by CVE-2021-0341 via com.squareup.okhttp3:okhttp (>=4.0.0-alpha01, <=4.9.1)

com.squareup.okhttp3:okhttp MAVEN version =4.0.0-alpha01, =3.30.0.4, =5.0.0, =5.0.0, =1.0.4, =1.0.0, =2.1.0, =19.9.0, =19.9.0, =19.9.0, =19.9.0, =19.9.0, =19.9.3, =19.9.0, =19.9.1, =21.9.3 and more Source cves: CVE-2021-0341 Source advisory: OSV:GHSA-3CQM-MF7H-PRRJ...

com.squareup.okhttp3.sample:crawler (3.12.5), com.squareup.okhttp3.sample:guide (3.12.5) +16 more potentially affected by CVE-2021-0341 via com.squareup.okhttp3:okhttp (3.12.5)

com.squareup.okhttp3:okhttp MAVEN version 3.12.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.okhttp3:okhttp and may be impacted: - com.squareup.okhttp3.sample:crawler 3.12.5 - com.squareup.okhttp3.sample:guide 3.12.5 -...

GHSA-3CQM-MF7H-PRRJ Square OkHttp can accept the wrong certificate

In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

com.apollographql.apollo3:apollo-android-support (>=3.0.0-dev2, <=3.0.0-dev12), com.apollographql.apollo3:apollo-cache-interceptor-jvm (>=3.0.0-dev2, <=3.0.0-dev13) +132 more potentially affected by CVE-2021-0341 via com.squareup.okhttp3:okhttp (3.12.11)

com.squareup.okhttp3:okhttp MAVEN version 3.12.11 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.okhttp3:okhttp and may be impacted: - com.apollographql.apollo3:apollo-android-support =3.0.0-dev2, =3.0.0-dev2, =3.0.0-dev2, =3.0.0-alpha01,...

cn.hyperchain:litesdk (>=0.0.1, <=1.4.3), cn.ipokerface:minio-spring (>=2.7.0, <=2.8.1) +417 more potentially affected by CVE-2021-0341 via com.squareup.okhttp3:okhttp (3.13.1)

com.squareup.okhttp3:okhttp MAVEN version 3.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.okhttp3:okhttp and may be impacted: - cn.hyperchain:litesdk =0.0.1, =2.7.0, =1.6.0, =1.6.0, =1.6.0, =1.6.0, =1.6.0, =1.6.0, =1.6.0, =1.6.0,...

com.squareup.okhttp3.sample:crawler (3.12.7), com.squareup.okhttp3.sample:guide (3.12.7) +19 more potentially affected by CVE-2021-0341 via com.squareup.okhttp3:okhttp (3.12.7)

com.squareup.okhttp3:okhttp MAVEN version 3.12.7 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.okhttp3:okhttp and may be impacted: - com.squareup.okhttp3.sample:crawler 3.12.7 - com.squareup.okhttp3.sample:guide 3.12.7 -...

ai.nextbillion:nb-maps-client (>=0.6.0a, <=1.7.1), au.org.consumerdatastandards:client (>=1.0.0-rc6, <=2.4.1) +859 more potentially affected by CVE-2021-0341 via com.squareup.okhttp3:okhttp (3.14.4)

com.squareup.okhttp3:okhttp MAVEN version 3.14.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.okhttp3:okhttp and may be impacted: - ai.nextbillion:nb-maps-client =0.6.0a, =1.0.0-rc6, =1.0.0-rc6, =1.2.0, =1.0.2, =1.0.0, =1.0.0, =5.7.1,...

com.nylas.sdk:nylas (>=2.0.0-beta.1, <=2.11.1), com.nylas.sdk:nylas-java-sdk (>=0.1.0, <=1.22.0) +21 more potentially affected by CVE-2021-0341 via com.squareup.okhttp3:okhttp (3.14.5)

com.squareup.okhttp3:okhttp MAVEN version 3.14.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.okhttp3:okhttp and may be impacted: - com.nylas.sdk:nylas =2.0.0-beta.1, =0.1.0, =1.22.0 - com.squareup.okhttp3.sample:crawler 3.14.5 -...

ai.nextbillion:nbmap-sdk-api (>=0.1.0, <=0.1.2), ai.nextbillion:nbmap-sdk-core (>=0.1.0, <=0.1.2) +1022 more potentially affected by CVE-2021-0341 via com.squareup.okhttp3:okhttp (3.14.7)

com.squareup.okhttp3:okhttp MAVEN version 3.14.7 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.okhttp3:okhttp and may be impacted: - ai.nextbillion:nbmap-sdk-api =0.1.0, =0.1.0, =1.2.0-alpha04, =1.2.0-alpha04, =1.5.0-rc4, =1.0, =1.0.0,...

cn.hydrz:dipper-map (>=1.0.0, <=1.0.1), cn.xphsc.boot:kubernetes-spring-boot-starer (1.0.0-rc) +170 more potentially affected by CVE-2021-0341 via com.squareup.okhttp3:okhttp (3.14.3)

com.squareup.okhttp3:okhttp MAVEN version 3.14.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.okhttp3:okhttp and may be impacted: - cn.hydrz:dipper-map =1.0.0, =2.7.1.5, =2.0.0-beta2, =0.0.1, =1.0.0, =2.3.0-beta, =2.0.0, =2.0.0, =2.1.0,...

club.pizzalord:galadriel (>=0.0.1, <=0.0.9), club.pizzalord:galadriel-authority (>=0.0.1, <=0.0.9) +334 more potentially affected by CVE-2021-0341 via com.squareup.okhttp3:okhttp (3.14.6)

com.squareup.okhttp3:okhttp MAVEN version 3.14.6 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.okhttp3:okhttp and may be impacted: - club.pizzalord:galadriel =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.5, =0.0.1, =0.0.1, =0.0.1, =0.0.2, =0.0.14...

com.9ls:nest-api-jdk (0.0.2), com.aliyun.schedulerx:schedulerx2-spring-boot-starter (>=1.3.4, <=1.9.0) +199 more potentially affected by CVE-2021-0341 via com.squareup.okhttp3:okhttp (3.14.8)

com.squareup.okhttp3:okhttp MAVEN version 3.14.8 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.okhttp3:okhttp and may be impacted: - com.9ls:nest-api-jdk 0.0.2 - com.aliyun.schedulerx:schedulerx2-spring-boot-starter =1.3.4, =1.1.1, =0.4....