okhttp: information disclosure via improperly used cryptographic function

In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Produc...

Moderate: Red Hat Security Advisory: Red Hat Single Sign-On 7.6.3 security update on RHEL 7

New Red Hat Single Sign-On 7.6.3 packages are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Streams: component version with information disclosure flaw

A flaw was found in Red Hat's AMQ-Streams, which ships a version of the OKHttp component with an information disclosure flaw via an exception triggered by a header containing an illegal value. This issue could allow an authenticated attacker to access information outside of their regular...

CVE-2023-0833

A flaw was found in Red Hat's AMQ-Streams, which ships a version of the OKHttp component with an information disclosure flaw via an exception triggered by a header containing an illegal value. This issue could allow an authenticated attacker to access information outside of their regular...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.9 XP 4.0.0.GA Security release

JBoss EAP XP 4.0.0.GA Security release on the EAP 7.4.9 base. See references for release notes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Security Bulletin: IBM Planning Analytics Workspace is affected by multiple vulnerabilities (CVE-2021-40690, CVE-2022-25647, XFID: 233967)

Summary IBM Planning Analytics Workspace is affected by multiple vulnerabilities. Apache Santuario Security for Java provides a mechanism for XML-Signature & XML Encryption syntax and processing CVE-2021-40690. Google Gson is an open-source Java library to serialize and deserialize Java objects t...

OKHttp Square Authentication Bypass Man-in-the-Middle

The vulnerability of the client’s HTTP library, OKHttp Square, is related to errors in the certificate authentication process. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions and execute a type of “man-in-the-middle” attack...

GHSA-3CQM-MF7H-PRRJ Square OkHttp can accept the wrong certificate

In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

Improper Certificate Validation

Overview com.squareup.okhttp3:okhttp is a HTTP & HTTP/2 client for Android and Java applications Affected versions of this package are vulnerable to Improper Certificate Validation via the verifyHostName function in OkHostnameVerifier.java. An attacker can gain unauthorized access to sensitive...

ai.cochl:sense-api (v0.0.1), ai.h2o:h2o-bindings (>=3.30.0.4, <=3.46.0.12) +4783 more potentially affected by CVE-2021-0341 via com.squareup.okhttp3:okhttp (>=4.0.0-alpha01, <=4.9.1)

com.squareup.okhttp3:okhttp MAVEN version =4.0.0-alpha01, =3.30.0.4, =5.0.0, =5.0.0, =1.0.4, =1.0.0, =2.1.0, =19.9.0, =19.9.0, =19.9.0, =19.9.0, =19.9.0, =19.9.3, =19.9.0, =19.9.1, =21.9.3 and more Source cves: CVE-2021-0341 Source advisory: GHSA-3CQM-MF7H-PRRJ...

ai.cochl:sense-api (v0.0.1), ai.h2o:h2o-bindings (>=3.30.0.4, <=3.46.0.12) +4783 more potentially affected by CVE-2021-0341 via com.squareup.okhttp3:okhttp (>=4.0.0-alpha01, <=4.9.1)

com.squareup.okhttp3:okhttp MAVEN version =4.0.0-alpha01, =3.30.0.4, =5.0.0, =5.0.0, =1.0.4, =1.0.0, =2.1.0, =19.9.0, =19.9.0, =19.9.0, =19.9.0, =19.9.0, =19.9.3, =19.9.0, =19.9.1, =21.9.3 and more Source cves: CVE-2021-0341 Source advisory: SNYK:JAVA-COMSQUAREUPOKHTTP3-13961111...

com.appunite:websockets-rxjava (>=4.0.0, <=4.0.1), com.signaturit.api:java-sdk (1.1.5) +13 more potentially affected by CVE-2021-0341 via com.squareup.okhttp3:okhttp (3.1.1)

com.squareup.okhttp3:okhttp MAVEN version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.okhttp3:okhttp and may be impacted: - com.appunite:websockets-rxjava =4.0.0, =4.0.1 - com.signaturit.api:java-sdk 1.1.5 -...

ai.deepsense:seahorse-executor-api_2.11 (>=1.4.2, <=1.4.3), ai.deepsense:seahorse-executor-commons_2.11 (>=1.4.2, <=1.4.3) +243 more potentially affected by CVE-2021-0341 via com.squareup.okhttp3:okhttp (3.2.0)

com.squareup.okhttp3:okhttp MAVEN version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.okhttp3:okhttp and may be impacted: - ai.deepsense:seahorse-executor-api2.11 =1.4.2, =1.4.2, =1.4.2, =1.4.2, =1.4.2, =3.8.2.1, =1.1.6, =0.5.0,...

com.redshepherd:redpay (1.0.0.dev1), com.squareup.okhttp3.sample:crawler (3.4.0-rc1) +16 more potentially affected by CVE-2021-0341 via com.squareup.okhttp3:okhttp (3.4.0-rc1)

com.squareup.okhttp3:okhttp MAVEN version 3.4.0-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.okhttp3:okhttp and may be impacted: - com.redshepherd:redpay 1.0.0.dev1 - com.squareup.okhttp3.sample:crawler 3.4.0-rc1 -...

com.github.antennaesdk.server:mms (0.1.6), com.github.seratch:jslack (>=0.1.5, <=1.0.0) +13 more potentially affected by CVE-2021-0341 via com.squareup.okhttp3:okhttp (3.4.0)

com.squareup.okhttp3:okhttp MAVEN version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.okhttp3:okhttp and may be impacted: - com.github.antennaesdk.server:mms 0.1.6 - com.github.seratch:jslack =0.1.5, =1.0.0 -...

ch.rasc:piwik-tracking (>=1.0.0, <=1.0.1), ch.viascom.groundwork:restclient-android (1.0) +139 more potentially affected by CVE-2021-0341 via com.squareup.okhttp3:okhttp (3.5.0)

com.squareup.okhttp3:okhttp MAVEN version 3.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.okhttp3:okhttp and may be impacted: - ch.rasc:piwik-tracking =1.0.0, =1.0.0, =0.0.1, =1.2.25, =1.1.16, =1.1.0, =9.17.0, =1.0.0, =1.0.4 -...

cc.drx:boot_2.12 (>=dj, <=dp), ch.epfl.scala:actions_2.12 (1.1.0-sourcedeps) +556 more potentially affected by CVE-2021-0341 via com.squareup.okhttp3:okhttp (3.7.0)

com.squareup.okhttp3:okhttp MAVEN version 3.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.okhttp3:okhttp and may be impacted: - cc.drx:boot2.12 =dj, =b1cf57d6, =b1cf57d6, =0.1.0, =1.0.0-x8+510-660ed3cb, =1.1.0+9-57ca9e0f, =2.5.0,...

br.com.basis:rancher-java-sdk (>=1.0.0-rc3, <=1.0.0), ch.aaap:harvest-client (>=0.2.1, <=1.1.9) +459 more potentially affected by CVE-2021-0341 via com.squareup.okhttp3:okhttp (3.8.0)

com.squareup.okhttp3:okhttp MAVEN version 3.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.okhttp3:okhttp and may be impacted: - br.com.basis:rancher-java-sdk =1.0.0-rc3, =0.2.1, =1.0.4, =2.0.2, =0.0.1, =1.2.9, =2.2.0, =1.2.8, =1.2.3,...

at.willhaben.willtest:browserstack (>=1.2.5, <=1.3.0), at.willhaben.willtest:core (>=1.2.5, <=1.3.0) +815 more potentially affected by CVE-2021-0341 via com.squareup.okhttp3:okhttp (3.9.1)

com.squareup.okhttp3:okhttp MAVEN version 3.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.okhttp3:okhttp and may be impacted: - at.willhaben.willtest:browserstack =1.2.5, =1.2.5, =1.2.5, =1.0.22, =18.3.0, =2.23.5, =1.0.4-release,...

ai.h2o:h2o-bindings (>=3.24.0.1, <=3.30.0.3), ai.idylnlp:idylnlp-dl4j (>=1.0.0, <=1.1.0) +1030 more potentially affected by CVE-2021-0341 via com.squareup.okhttp3:okhttp (3.10.0)

com.squareup.okhttp3:okhttp MAVEN version 3.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.okhttp3:okhttp and may be impacted: - ai.h2o:h2o-bindings =3.24.0.1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0,...