certPinningVulnerableOkHttp

OkHttp simple-client app vulnerable to CVE-2016-2402 This is a fork of the default simple-client from the okhttp project. Simple-client is a Java app that just does a GET request to https://api.github.com and fetches the names of okhttp's contributors. This fork has been edited so that OkHttp 3.0...

cert-pinning-flaw-poc

cert pinning flaw POC Simple POC script for testing CVE-2016-2402 and similar flaws. Read my blog post for details. This utility will set up a HTTPS server that servers a malicious certificate chain to the client for a specific domain. If traffic from an app with a vulnerable certificate pinning...

Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities

Summary IBM Cloud Pak for Security includes components with known vulnerabilities. These have been updated in the latest release and vulnerabilities have been addressed. Please follow the instructions in the Remediation/Fixes section below to update to the latest version of Cloud Pak for Security...

com.aliyun.openservices:sls-android-okhttp (1.0.0), com.appunite:websockets-rxjava (>=4.0.0, <=4.0.1) +89 more potentially affected by CVE-2016-2402 via com.squareup.okhttp3:okhttp (>=3.0.0, <=3.1.1)

com.squareup.okhttp3:okhttp MAVEN version =3.0.0, =4.0.0, =0.2.0, =1.0.1, =2.0.0, =1.0.0, =1.3.0, =0.1.0-beta02, =17.0.2, =17.0.6, =17.0.0, =17.0.1 and more Source cves: CVE-2016-2402 Source advisory: OSV:GHSA-4HC2-JH7R-WRC3...

com.aliyun.openservices:sls-android-okhttp (1.0.0), com.appunite:websockets-rxjava (>=4.0.0, <=4.0.1) +89 more potentially affected by CVE-2016-2402 via com.squareup.okhttp3:okhttp (>=3.0.0, <=3.1.1)

com.squareup.okhttp3:okhttp MAVEN version =3.0.0, =4.0.0, =0.2.0, =1.0.1, =2.0.0, =1.0.0, =1.3.0, =0.1.0-beta02, =17.0.2, =17.0.6, =17.0.0, =17.0.1 and more Source cves: CVE-2016-2402 Source advisory: GHSA-4HC2-JH7R-WRC3...

OkHttp Certificate Pinning Vulnerability CVE-2016-2402

h3. Issue Summary Portfolio uses Okhttp 2.2.0 which has an identified vulnerability: https://nvd.nist.gov/vuln/detail/CVE-2016-2402 https://www.securityfocus.com/bid/83296/info https://publicobject.com/2016/02/11/okhttp-certificate-pinning-vulnerability/ h3. Steps to Reproduce...

OkHttp Certificate Pinning Vulnerability CVE-2016-2402

h3. Issue Summary Portfolio uses Okhttp 2.2.0 which has an identified vulnerability: https://nvd.nist.gov/vuln/detail/CVE-2016-2402 https://www.securityfocus.com/bid/83296/info https://publicobject.com/2016/02/11/okhttp-certificate-pinning-vulnerability/ h3. Steps to Reproduce...

CVE-2016-2402

OkHttp before 2.7.4 and 3.x before 3.1.2 allows man-in-the-middle attackers to bypass certificate pinning by sending a certificate chain with a certificate from a non-pinned trusted CA and the pinned certificate...

CVE-2016-2402

OkHttp before 2.7.4 and 3.x before 3.1.2 allows man-in-the-middle attackers to bypass certificate pinning by sending a certificate chain with a certificate from a non-pinned trusted CA and the pinned certificate...

com.aliyun.openservices:sls-android-okhttp (1.0.0), com.appunite:websockets-rxjava (>=4.0.0, <=4.0.1) +89 more potentially affected by CVE-2016-2402 via com.squareup.okhttp3:okhttp (>=3.0.0, <=3.1.1)

com.squareup.okhttp3:okhttp MAVEN version =3.0.0, =4.0.0, =0.2.0, =1.0.1, =2.0.0, =1.0.0, =1.3.0, =0.1.0-beta02, =17.0.2, =17.0.6, =17.0.0, =17.0.1 and more Source cves: CVE-2016-2402 Source advisory: MEND:CVE-2016-2402...

CVE-2016-2402

CVE-2016-2402 affects OkHttp, where MITM bypass of certificate pinning is possible. The vulnerability occurs when an attacker presents a certificate chain containing a non-pinned trusted CA alongside the pinned certificate, enabling bypass of pinning checks in OkHttp before 2.7.4 and in 3.x befor...