PT-2016-3433 · Square · Okhttp

John Kozyrakis · Publicado 2016-02-10 · Atualizado 2022-05-13 · CVE-2016-2402

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:N/AC:M/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions OkHttp versions 2.7.3 and earlier, OkHttp versions 3.x before 3.1.2

Description The issue allows man-in-the-middle attackers to bypass certificate pinning by sending a certificate chain with a certificate from a non-pinned trusted CA and the pinned certificate. This is related to errors in the certificate authentication procedure, which can be exploited by a remote attacker to bypass existing security restrictions and implement a man-in-the-middle attack.

Recommendations For OkHttp versions 2.7.3 and earlier, update to version 2.7.4 or later. For OkHttp versions 3.x before 3.1.2, update to version 3.1.2 or later.

Exploit

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

BDU:2022-04756

CVE-2016-2402

GHSA-4HC2-JH7R-WRC3

Produtos afetados

Okhttp

Referências · 16

• 🔥 https://github.com/ikoz/cert-pinning-flaw-poc · Exploit
• 🔥 https://github.com/ikoz/certPinningVulnerableOkHttp · Exploit
• https://github.com/square/okhttp · Nota
• https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E · Nota
• https://publicobject.com/2016/02/11/okhttp-certificate-pinning-vulnerability · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2022-04756 · Nota de Segurança
• https://koz.io/pinning-cve-2016-2402 · Nota
• https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E · Nota
• https://t.me/cvenotify/7141 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2016-2402 · Nota de Segurança
• https://vuldb.com/ru/?id.96298 · Nota
• http://openwall.com/lists/oss-security/2016/02/18/7 · Nota
• http://openwall.com/lists/oss-security/2016/02/10/8 · Nota
• https://osv.dev/vulnerability/CVE-2016-2402 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2402 · Nota