GitHub Advisoryadvisory · Maven

GHSA-3cqm-mf7h-prrj Square OkHttp can accept the wrong certificate

HIGH Published 2022-05-24 Modified 2025-11-13 Official page ↗
Aliases
CVE-2021-0341
Ecosystem
Maven
Packages
com.squareup.okhttp3:okhttp
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-295
Reviewed
2025-11-13

Affected packages

• Maven com.squareup.okhttp3:okhttp: < 4.9.2 → fixed in 4.9.2

Description

In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11 Android ID: A-171980069

Related

Alias · CVE (1)

  • CVE-2021-0341 In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used… vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References