PT-2019-11511 · Kevinsawicki+1 · Oss Http Request

Published 2019-07-23 · Updated 2022-05-24 · CVE-2019-1010206

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: OSS Http Request (Apache Cordova Plugin) version 6 OSS Http Request (kevinsawicki/http-request) (affected versions not specified)

Description: The issue concerns missing SSL/TLS certificate validation, which can lead to certificate spoofing. This problem is relevant when using the library for HTTPS communication. The attack vector in this case is also certificate spoofing.

Recommendations: For OSS Http Request (Apache Cordova Plugin) version 6, update the library to a version that includes SSL/TLS certificate validation. For OSS Http Request (kevinsawicki/http-request), at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2019-1010206

GHSA-8MX3-GP3P-VGG7

Affected Products

Oss Http Request

References · 4

• https://osv.dev/vulnerability/CVE-2019-1010206 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1010206 · Security Note
• https://osv.dev/vulnerability/GHSA-8mx3-gp3p-vgg7 · Vendor Advisory
• https://github.com/kevinsawicki/http-request/blob/master/lib/src/main/java/com/github/kevinsawicki/http/HttpRequest.java · Note