Improper Certificate Validation Affecting org.asynchttpclient:async-http-client-api Open this link in a new tab package, versions [,2.0.0-alpha1)
Attack Complexity
Low
Integrity
High
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications-
snyk-id
SNYK-JAVA-ORGASYNCHTTPCLIENT-174923
-
published
25 Aug 2019
-
disclosed
13 Jul 2013
-
credit
Unknown
Introduced: 13 Jul 2013
CWE-295 Open this link in a new tabHow to fix?
Upgrade org.asynchttpclient:async-http-client-api
to version 2.0.0-alpha1 or higher.
Overview
org.asynchttpclient:async-http-client-api is a library for Async Http Client (AHC) API classes.
Affected versions of this package are vulnerable to Improper Certificate Validation. SSL/TLS certificate verification was found to be disabled under certain conditions where client certificates were used to establish encrypted communications. The package also did not verify that the server hostname matched the domain name in the subject's Common Name or subjectAltName field in X.509 certificates. This could allow a man-in-the-middle attacker to spoof an SSL server if they had a certificate that was valid for any domain name.