GHSA-3cqm-mf7h-prrj

Square OkHttp can accept the wrong certificate

At a glance

Published: 2022-05-24 17:41 UTC
Updated: 2026-09-10 03:49 UTC
CVE: CVE-2021-0341
Aliases: A-171980069, ASB-A-171980069
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11 Android ID: A-171980069

Affected packages

Package	Versions
Maven · com.squareup.okhttp3:okhttp	introduced 0, fixed 4.9.2

References

https://nvd.nist.gov/vuln/detail/CVE-2021-0341 ADVISORY
https://github.com/square/okhttp/issues/6724 WEB
https://github.com/square/okhttp/pull/6741 WEB
https://github.com/square/okhttp/commit/f574ea2f5259d9040f264ddeb582fb1ce563f10c WEB
https://github.com/square/okhttp PACKAGE
https://source.android.com/security/bulletin/2021-02-01 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database