Homepage About Snyk

Improper Certificate Validation Affecting org.asynchttpclient:async-http-client-api Open this link in a new tab package, versions [,2.0.0-alpha1)

0.0
high

  • Attack Complexity

    Low

  • Integrity

    High

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

  • snyk-id

    SNYK-JAVA-ORGASYNCHTTPCLIENT-174923

  • published

    25 Aug 2019

  • disclosed

    13 Jul 2013

  • credit

    Unknown

Report a new vulnerability Found a mistake?

Introduced: 13 Jul 2013

CWE-295 Open this link in a new tab

How to fix?

Upgrade org.asynchttpclient:async-http-client-api to version 2.0.0-alpha1 or higher.

Overview

org.asynchttpclient:async-http-client-api is a library for Async Http Client (AHC) API classes.

Affected versions of this package are vulnerable to Improper Certificate Validation. SSL/TLS certificate verification was found to be disabled under certain conditions where client certificates were used to establish encrypted communications. The package also did not verify that the server hostname matched the domain name in the subject's Common Name or subjectAltName field in X.509 certificates. This could allow a man-in-the-middle attacker to spoof an SSL server if they had a certificate that was valid for any domain name.