GitHub Advisoryadvisory · Maven

GHSA-8mx3-gp3p-vgg7 kevinsawicki/http-request Missing certificate validation

MEDIUM Published 2022-05-24 Modified 2023-07-14 Official page ↗
Aliases
CVE-2019-1010206
Ecosystem
Maven
Packages
com.github.kevinsawicki:http-request
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-295
Reviewed
2022-11-03

Affected packages

• Maven com.github.kevinsawicki:http-request: <= 6.0 (no fix yet)

Description

OSS Http Request (kevinsawicki/http-request) is missing SSL/TLS certificate validation. The impact is: certificate spoofing. The component is: use this library when https communication. The attack vector is: certificate spoofing.

Related

Alias · CVE (1)

  • CVE-2019-1010206 OSS Http Request (Apache Cordova Plugin) 6 is affected by: Missing SSL certificate validation. vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References