CVEvulnerability
CVE-2017-7192
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2017-04-06
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-295
Description
WebSocket.swift in Starscream before 2.0.4 allows an SSL Pinning bypass because of incorrect management of the certValidated variable (it can be set to true but cannot be set to false).
Affected configurations
• starscream project starscream (<= 2.0.3)
Related
Weakness · CWE (1)
- CWE-295 Improper Certificate Validation weakness
References
- http://seclists.org/bugtraq/2017/Apr/66 seclists.org
- https://github.com/daltoniam/Starscream/commit/dbeb1190b8dcbff4f0b797f9e9d9b9b864d1f0d6 Patch, Third Party Advisory
- https://github.com/daltoniam/Starscream/releases/tag/2.0.4 Release Notes, Third Party Advisory
- http://seclists.org/bugtraq/2017/Apr/66 seclists.org
- https://github.com/daltoniam/Starscream/commit/dbeb1190b8dcbff4f0b797f9e9d9b9b864d1f0d6 Patch, Third Party Advisory
- https://github.com/daltoniam/Starscream/releases/tag/2.0.4 Release Notes, Third Party Advisory