Description
In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-171980069
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Android | Android-8.1 Android-9 Android-10 Android-11 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Single Sign On 7 | rh-sso7-keycloak +1 | 18.0.7-1.redhat_00001.1.el7sso | RHSA-2023:2707, RHSA-2023:2706, RHSA-2023:2705 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.squareup.okhttp3:okhttp | < 4.9.2 | 4.9.2 | GHSA-3cqm-mf7h-prrj |
Advisories 10
- RHSA-2023:2707 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.3 security update on RHEL 9 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:2706 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.3 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:2705 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.3 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- WID-SEC-2026-1229 Atlassian Bamboo, Bitbucket, Confluence, Jira: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 2, 2026
- WID-SEC-2024-0123 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 7, 2026
- WID-SEC-2026-1194 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 21, 2026
- WID-SEC-2023-1193 Red Hat Single Sign On: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 10, 2025
- ICSA-24-074-07 Siemens SIMATIC CISA ICS & IT advisories · Mar 14, 2024
- SSA-770721 SSA-770721: Multiple Vulnerabilities in SIMATIC RF160B before V2.2 Siemens ProductCERT · Mar 12, 2024
- WID-SEC-2023-0360 Google Android: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 10, 2023