Improper Certificate Validation Affecting org.asynchttpclient:async-http-client-api Open this link in a new tab package, versions [,2.0.0-alpha1)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.Test your applications
25 Aug 2019
13 Jul 2013
Introduced: 13 Jul 2013CWE-295 Open this link in a new tab
How to fix?
org.asynchttpclient:async-http-client-api to version 2.0.0-alpha1 or higher.
org.asynchttpclient:async-http-client-api is a library for Async Http Client (AHC) API classes.
Affected versions of this package are vulnerable to Improper Certificate Validation. SSL/TLS certificate verification was found to be disabled under certain conditions where client certificates were used to establish encrypted communications. The package also did not verify that the server hostname matched the domain name in the subject's Common Name or subjectAltName field in X.509 certificates. This could allow a man-in-the-middle attacker to spoof an SSL server if they had a certificate that was valid for any domain name.