Skip to content

okhttp-4.8.1.jar: 2 vulnerabilities (highest severity is: 7.5) #50

Open
Open
okhttp-4.8.1.jar: 2 vulnerabilities (highest severity is: 7.5)#50
Labels
Mend: dependency security vulnerabilitySecurity vulnerability detected by Mend

Description

@mend-for-github-com
mend-for-github-com
bot
opened on Jul 17, 2024
Vulnerable Library - okhttp-4.8.1.jar

Square’s meticulous HTTP client for Java and Kotlin.

Library home page: https://square.github.io/okhttp/

Sample Path to Dependency File: /in-app-messaging-kotlin/app/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom,/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom,/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom,/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom,/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom,/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom,/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom,/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom,/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom

Vulnerabilities

Vulnerability Severity CVSS Dependency Type Fixed in (okhttp version) Remediation Possible**
CVE-2021-0341 High 7.5 okhttp-4.8.1.jar Direct com.squareup.okhttp3:okhttp:4.9.2 ❌
CVE-2023-0833 Medium 4.7 okhttp-4.8.1.jar Direct 4.9.2 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2021-0341

Vulnerable Library - okhttp-4.8.1.jar

Square’s meticulous HTTP client for Java and Kotlin.

Library home page: https://square.github.io/okhttp/

Sample Path to Dependency File: /in-app-messaging-kotlin/app/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom,/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom,/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom,/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom,/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom,/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom,/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom,/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom,/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom

Dependency Hierarchy:

  • ❌ okhttp-4.8.1.jar (Vulnerable Library)

Found in base branch: main

Vulnerability Details

In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-171980069

Publish Date: 2021-02-10

URL: CVE-2021-0341

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-3cqm-mf7h-prrj

Release Date: 2021-02-10

Fix Resolution: com.squareup.okhttp3:okhttp:4.9.2

CVE-2023-0833

Vulnerable Library - okhttp-4.8.1.jar

Square’s meticulous HTTP client for Java and Kotlin.

Library home page: https://square.github.io/okhttp/

Sample Path to Dependency File: /in-app-messaging-kotlin/app/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom,/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom,/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom,/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom,/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom,/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom,/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom,/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom,/modules-2/files-2.1/com.squareup.okhttp3/okhttp/4.8.1/6674a5ab0fe82b134a2fe02a18ccf9c51e9a0b2/okhttp-4.8.1.pom

Dependency Hierarchy:

  • ❌ okhttp-4.8.1.jar (Vulnerable Library)

Found in base branch: main

Vulnerability Details

A flaw was found in Red Hat's AMQ-Streams, which ships a version of the OKHttp component with an information disclosure flaw via an exception triggered by a header containing an illegal value. This issue could allow an authenticated attacker to access information outside of their regular permissions.

Publish Date: 2023-09-27

URL: CVE-2023-0833

CVSS 3 Score Details (4.7)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2023-09-27

Fix Resolution: 4.9.2

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Mend: dependency security vulnerabilitySecurity vulnerability detected by Mend

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions