Homepage About Snyk

Improper Certificate Validation Affecting org.asynchttpclient:async-http-client-api package, versions [,2.0.0-alpha1)

0.0
high

Snyk CVSS

    Attack Complexity Low
    Integrity High

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JAVA-ORGASYNCHTTPCLIENT-174923
  • published 25 Aug 2019
  • disclosed 13 Jul 2013
  • credit Unknown
Report a new vulnerability Found a mistake?

Introduced: 13 Jul 2013

CVE - NOT AVAILABLE
CWE-295 Open this link in a new tab

How to fix?

Upgrade org.asynchttpclient:async-http-client-api to version 2.0.0-alpha1 or higher.

Overview

org.asynchttpclient:async-http-client-api is a library for Async Http Client (AHC) API classes.

Affected versions of this package are vulnerable to Improper Certificate Validation. SSL/TLS certificate verification was found to be disabled under certain conditions where client certificates were used to establish encrypted communications. The package also did not verify that the server hostname matched the domain name in the subject's Common Name or subjectAltName field in X.509 certificates. This could allow a man-in-the-middle attacker to spoof an SSL server if they had a certificate that was valid for any domain name.