Improper Certificate Validation Affecting org.asynchttpclient:async-http-client-api package, versions [,2.0.0-alpha1)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGASYNCHTTPCLIENT-174923
- published 25 Aug 2019
- disclosed 13 Jul 2013
- credit Unknown
How to fix?
Upgrade org.asynchttpclient:async-http-client-api to version 2.0.0-alpha1 or higher.
Overview
org.asynchttpclient:async-http-client-api is a library for Async Http Client (AHC) API classes.
Affected versions of this package are vulnerable to Improper Certificate Validation. SSL/TLS certificate verification was found to be disabled under certain conditions where client certificates were used to establish encrypted communications. The package also did not verify that the server hostname matched the domain name in the subject's Common Name or subjectAltName field in X.509 certificates. This could allow a man-in-the-middle attacker to spoof an SSL server if they had a certificate that was valid for any domain name.