Unscored CVE-2017-7192 EUVD-2017-16230GHSA-gm5r-37pp-62p4

WebSocket.swift in Starscream before 2.0.4 allows an SSL Pinning bypass because of incorrect management of the certValidated variable (it c…

Published Apr 6, 2017 · Updated Aug 5, 2024 · Assigned by mitre

Description

WebSocket.swift in Starscream before 2.0.4 allows an SSL Pinning bypass because of incorrect management of the certValidated variable (it can be set to true but cannot be set to false).

References

https://github.com/daltoniam/Starscream/releases/tag/2.0.4
https://github.com/daltoniam/Starscream/commit/dbeb1190b8dcbff4f0b797f9e9d9b9b864d1f0d6
http://seclists.org/bugtraq/2017/Apr/66