PT-2019-11511 · Kevinsawicki+1 · Oss Http Request

Publicado 2019-07-23 · Atualizado 2022-05-24 · CVE-2019-1010206

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: OSS Http Request (Apache Cordova Plugin) version 6 OSS Http Request (kevinsawicki/http-request) (affected versions not specified)

Description: The issue concerns missing SSL/TLS certificate validation, which can lead to certificate spoofing. This problem is relevant when using the library for HTTPS communication. The attack vector in this case is also certificate spoofing.

Recommendations: For OSS Http Request (Apache Cordova Plugin) version 6, update the library to a version that includes SSL/TLS certificate validation. For OSS Http Request (kevinsawicki/http-request), at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2019-1010206

GHSA-8MX3-GP3P-VGG7

Produtos afetados

Oss Http Request

Referências · 4

• https://github.com/kevinsawicki/http-request/blob/master/lib/src/main/java/com/github/kevinsawicki/http/HttpRequest.java · Nota
• https://osv.dev/vulnerability/CVE-2019-1010206 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-1010206 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-8mx3-gp3p-vgg7 · Aviso do Fabricante