| Package | Affected versions | Patched versions |
|---|---|---|
| com.squareup.okhttp3:okhttp | ≥ 3.0.0, < 3.1.2< 2.7.4 | 3.1.22.7.4 |
| okhttp | ≤ 2.7.3 | |
| okhttp3 | = 3.0.0= 3.0.1= 3.1.0= 3.1.1 |
OkHttp before 2.7.4 and 3.x before 3.1.2 allows man-in-the-middle attackers to bypass certificate pinning by sending a certificate chain with a certificate from a non-pinned trusted CA and the pinned certificate.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free