Crawling Azure devops repositories#94
Conversation
![sonatype-lift[bot]](https://avatars.githubusercontent.com/in/9843?s=60&v=4){kind=small}
| </dependency> | ||
|
|
||
|
|
||
| <dependency> |
There was a problem hiding this comment.
Severe OSS Vulnerability:
pkg:maven/com.squareup.okhttp3/logging-interceptor@3.10.0
0 Critical, 1 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 1 dependencies
Components
pkg:maven/com.squareup.okhttp3/okhttp@3.10.0
SEVERE Vulnerabilities (1)
[CVE-2018-20200] ** DISPUTED ** CertificatePinner.java in OkHttp 3.x through 3.12.0 allows man-in...
** DISPUTED ** CertificatePinner.java in OkHttp 3.x through 3.12.0 allows man-in-the-middle attackers to bypass certificate pinning by changing SSLContext and the boolean values while hooking the application. NOTE: This id is disputed because some parties don't consider this is a vulnerability. Their rationale can be found in square/okhttp#4967.
CVSS Score: 5.9
CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
| </dependency> | ||
|
|
||
|
|
||
| <dependency> |
There was a problem hiding this comment.
Critical OSS Vulnerability:
pkg:maven/com.squareup.okhttp3/logging-interceptor@3.14.9
1 Critical, 0 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 1 dependencies
Components
pkg:maven/com.squareup.okhttp3/okhttp@3.14.9
CRITICAL Vulnerabilities (1)
[CVE-2021-0341] CWE-295: Improper Certificate Validation
In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-171980069
CVSS Score: 7.5
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE: CWE-295
(at-me in a reply with help or ignore)
| @@ -94,9 +94,15 @@ | |||
| <dependency> | |||
There was a problem hiding this comment.
Critical OSS Vulnerability:
pkg:maven/com.squareup.okhttp3/okhttp@3.14.9
1 Critical, 0 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 1 dependencies
Components
pkg:maven/com.squareup.okhttp3/okhttp@3.14.9
CRITICAL Vulnerabilities (1)
[CVE-2021-0341] CWE-295: Improper Certificate Validation
In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-171980069
CVSS Score: 7.5
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE: CWE-295
(at-me in a reply with help or ignore)
…tests by being loaded by default
… shared easily and safely
vincent-fuchs
force-pushed
the
crawlingAzureDevops
branch
from
15aa162 to
9f53818
Compare
1 participant
No description provided.