| Vulnerability Name: | CVE-2018-20200 | ||||||||||||||||||||||||
| Assigned: | 2018-12-18 | ||||||||||||||||||||||||
| Published: | 2019-04-18 | ||||||||||||||||||||||||
| Updated: | 2020-12-16 | ||||||||||||||||||||||||
| Summary: | ** DISPUTED ** CertificatePinner.java in OkHttp 3.x through 3.12.0 allows man-in-the-middle attackers to bypass certificate pinning by changing SSLContext and the boolean values while hooking the application. Note: This id is disputed because some parties don't consider this is a vulnerability. Their rationale can be found in https://github.com/square/okhttp/issues/4967. | ||||||||||||||||||||||||
| CVSS v3 Severity: | 5.9 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
| ||||||||||||||||||||||||
| CVSS v2 Severity: | 4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
| ||||||||||||||||||||||||
| Vulnerability Type: | CWE-295 | ||||||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2018-20200 Source: MISC Type: Exploit, Third Party Advisory https://cxsecurity.com/issue/WLB-2018120252 Source: MISC Type: Patch, Third Party Advisory https://github.com/square/okhttp/commits/master Source: MISC Type: UNKNOWN https://github.com/square/okhttp/issues/4967 Source: MISC Type: Product https://github.com/square/okhttp/releases Source: MLIST Type: UNKNOWN [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities Source: MLIST Type: UNKNOWN [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities Source: MLIST Type: UNKNOWN [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities Source: MLIST Type: UNKNOWN [flink-user] 20201022 Dependency vulnerabilities with flink 1.11.1 version Source: MLIST Type: UNKNOWN [flink-issues] 20201023 [jira] [Assigned] (FLINK-19784) Upgrade okhttp to 3.13.0 or newer due to CVE-2018-20200 Source: MLIST Type: UNKNOWN [flink-issues] 20201026 [jira] [Commented] (FLINK-19784) Upgrade okhttp to 3.13.0 or newer due to CVE-2018-20200 Source: MLIST Type: UNKNOWN [flink-issues] 20201023 [jira] [Commented] (FLINK-19784) Upgrade okhttp to 3.13.0 or newer due to CVE-2018-20200 Source: MLIST Type: UNKNOWN [pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list Source: MLIST Type: UNKNOWN [flink-issues] 20201023 [jira] [Updated] (FLINK-19784) Upgrade okhttp to 3.13.0 or newer due to CVE-2018-20200 Source: MLIST Type: UNKNOWN [flink-issues] 20201026 [jira] [Closed] (FLINK-19784) Upgrade okhttp to 3.13.0 or newer due to CVE-2018-20200 Source: MISC Type: Third Party Advisory https://square.github.io/okhttp/3.x/okhttp/ | ||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Denotes that component is vulnerable | ||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||
| |||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||