PT-2016-3433 · Square · Okhttp

John Kozyrakis · Published 2016-02-10 · Updated 2022-05-13 · CVE-2016-2402

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions OkHttp versions 2.7.3 and earlier, OkHttp versions 3.x before 3.1.2

Description The issue allows man-in-the-middle attackers to bypass certificate pinning by sending a certificate chain with a certificate from a non-pinned trusted CA and the pinned certificate. This is related to errors in the certificate authentication procedure, which can be exploited by a remote attacker to bypass existing security restrictions and implement a man-in-the-middle attack.

Recommendations For OkHttp versions 2.7.3 and earlier, update to version 2.7.4 or later. For OkHttp versions 3.x before 3.1.2, update to version 3.1.2 or later.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

BDU:2022-04756

CVE-2016-2402

GHSA-4HC2-JH7R-WRC3

Affected Products

Okhttp

References · 16

• 🔥 https://github.com/ikoz/cert-pinning-flaw-poc · Exploit
• 🔥 https://github.com/ikoz/certPinningVulnerableOkHttp · Exploit
• https://publicobject.com/2016/02/11/okhttp-certificate-pinning-vulnerability · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04756 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-2402 · Security Note
• https://osv.dev/vulnerability/CVE-2016-2402 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4hc2-jh7r-wrc3 · Vendor Advisory
• https://github.com/square/okhttp · Note
• https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E · Note
• https://koz.io/pinning-cve-2016-2402 · Note
• https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E · Note
• https://t.me/cvenotify/7141 · Telegram Post
• https://vuldb.com/ru/?id.96298 · Note
• http://openwall.com/lists/oss-security/2016/02/18/7 · Note
• http://openwall.com/lists/oss-security/2016/02/10/8 · Note