https://bugzilla.redhat.com/show_bug.cgi?id=1709379
Bug ID: 1709379 Summary: CVE-2018-20200 okhttp: certificate pinning bypass Product: Security Response Hardware: All OS: Linux Status: NEW Whiteboard: impact=moderate,public=20190419,reported=20190419,sour ce=cve,cvss3=6.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/ I:L/A:N,cwe=CWE-300,fedora-all/okhttp=affected,openshi ft-enterprise-3/okhttp=new,fuse-7/okhttp=new,rhpam-7/o khttp=new,rhdm-7/okhttp=new,springboot-1/okhttp=new Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: msiddiqu@redhat.com CC: ahardin@redhat.com, aileenc@redhat.com, akoufoud@redhat.com, alazarot@redhat.com, almorale@redhat.com, anstephe@redhat.com, avibelli@redhat.com, bgeorges@redhat.com, bleanhar@redhat.com, ccoleman@redhat.com, chazlett@redhat.com, cmoulliard@redhat.com, dedgar@redhat.com, eparis@redhat.com, etirelli@redhat.com, gerard@ryan.lt, ibek@redhat.com, ikanello@redhat.com, janstey@redhat.com, java-sig-commits@lists.fedoraproject.org, jbalunas@redhat.com, jgoulding@redhat.com, jochrist@redhat.com, jokerman@redhat.com, jpallich@redhat.com, jshepherd@redhat.com, krathod@redhat.com, kverlaen@redhat.com, lpetrovi@redhat.com, lthon@redhat.com, mchappel@redhat.com, mizdebsk@redhat.com, mnovotny@redhat.com, mszynkie@redhat.com, paradhya@redhat.com, pgallagh@redhat.com, puntogil@libero.it, rrajasek@redhat.com, rruss@redhat.com, rsynek@redhat.com, sdaley@redhat.com, trogers@redhat.com Target Milestone: --- Classification: Other
CertificatePinner.java in OkHttp 3.x through 3.12.0 allows man-in-the-middle attackers to bypass certificate pinning by changing SSLContext and the boolean values while hooking the application.
Upstream issue:
https://github.com/square/okhttp/issues/4967
References:
https://cxsecurity.com/issue/WLB-2018120252 https://github.com/square/okhttp/commits/master https://github.com/square/okhttp/releases https://square.github.io/okhttp/3.x/okhttp/
https://bugzilla.redhat.com/show_bug.cgi?id=1709379
msiddiqu@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1709380
--- Comment #1 from msiddiqu@redhat.com --- Created okhttp tracking bugs for this issue:
Affects: fedora-all [bug 1709380]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1709380 [Bug 1709380] CVE-2018-20200 okhttp: certificate pinning bypass [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1709379
msiddiqu@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1709384
https://bugzilla.redhat.com/show_bug.cgi?id=1709379
Mark Knowles mknowles@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2019 |impact=moderate,public=2019 |0419,reported=20190419,sour |0419,reported=20190419,sour |ce=cve,cvss3=6.5/CVSS:3.0/A |ce=cve,cvss3=6.5/CVSS:3.0/A |V:N/AC:L/PR:N/UI:N/S:U/C:L/ |V:N/AC:L/PR:N/UI:N/S:U/C:L/ |I:L/A:N,cwe=CWE-300,fedora- |I:L/A:N,cwe=CWE-300,fedora- |all/okhttp=affected,openshi |all/okhttp=affected,openshi |ft-enterprise-3/okhttp=new, |ft-enterprise-3/okhttp=affe |fuse-7/okhttp=new,rhpam-7/o |cted,fuse-7/okhttp=new,rhpa |khttp=new,rhdm-7/okhttp=new |m-7/okhttp=new,rhdm-7/okhtt |,springboot-1/okhttp=new |p=new,springboot-1/okhttp=n | |ew
--- Comment #2 from Mark Knowles mknowles@redhat.com --- Updated OpenShift Container Platform
https://bugzilla.redhat.com/show_bug.cgi?id=1709379
--- Comment #3 from Sam Fowler sfowler@redhat.com --- Statement:
OkHttp is used by OpenShift Container Platform in the Aggregated Logging stack. This issue is not considered a vulnerability for OpenShift Container Platform as the prerequisite for exploitation is the ability to inject code into the application.
https://bugzilla.redhat.com/show_bug.cgi?id=1709379
Product Security DevOps Team prodsec-dev@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |NOTABUG Last Closed| |2019-12-11 01:24:01
--- Comment #5 from Product Security DevOps Team prodsec-dev@redhat.com --- This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
https://access.redhat.com/security/cve/cve-2018-20200
https://bugzilla.redhat.com/show_bug.cgi?id=1709379 Bug 1709379 depends on bug 1709380, which changed state.
Bug 1709380 Summary: CVE-2018-20200 okhttp: certificate pinning bypass [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1709380
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |WONTFIX
https://bugzilla.redhat.com/show_bug.cgi?id=1709379
Paramvir jindal pjindal@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |aboyko@redhat.com, | |drieden@redhat.com, | |pdrozd@redhat.com, | |pjindal@redhat.com, | |sthorger@redhat.com
java-sig-commits@lists.fedoraproject.org
-
bugzilla＠redhat.com