PT-2020-12511 · Unknown · Java-Websocket

Peter Stöckli · Published 2020-05-07 · Updated 2021-10-07 · CVE-2020-11050

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Java-WebSocket versions 1.4.1 and earlier

Description The issue is related to an improper validation of certificates with host mismatch, where the WebSocketClient does not perform SSL hostname validation. This means that SSL certificates of other hosts are accepted as long as they are trusted. To exploit this, an attacker has to perform a man-in-the-middle (MITM) attack between a Java application using the Java-WebSocket Client and a WebSocket server it's connecting to. Normally, TLS protects users and systems against MITM attacks, but it cannot if certificates from other trusted hosts are accepted by the client.

Recommendations For Java-WebSocket versions 1.4.1 and earlier, update to version 1.5.0 or later to resolve the issue. As a temporary workaround, consider disabling the use of SSL certificates from other trusted hosts until a patch is available. Restrict access to the WebSocketClient to minimize the risk of exploitation. Avoid using the WebSocketClient in environments where MITM attacks are a significant concern until the issue is resolved.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-297

CWE-295

Related Identifiers

CVE-2020-11050

GHSA-GW55-JM4H-X339

Affected Products

Java-Websocket

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-11050 · Security Note
• https://osv.dev/vulnerability/GHSA-gw55-jm4h-x339 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-11050 · Vendor Advisory
• https://github.com/TooTallNate/Java-WebSocket/security/advisories/GHSA-gw55-jm4h-x339 · Note
• https://github.com/TooTallNate/Java-WebSocket · Note
• https://t.me/cvenotify/3654 · Telegram Post
• https://t.me/cvenotify/22075 · Telegram Post