Skip to content
Fencer Intel
high 7.5

CVE-2021-0341 json

Square OkHttp can accept the wrong certificate

published 5y ago modified last mo. also GHSA-3cqm-mf7h-prrj , EUVD-2021-2960

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 60%
public exploits
0
none known

Summary

In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-171980069

Patch / fix

  • maven com.squareup.okhttp3:okhttp 4.9.2
  • rh-sso7-keycloak red hat single sign on 7.6 18.0.7-1.redhat_00001.1.el9sso
  • rh-sso7-keycloak-server red hat single sign on 7.6 18.0.7-1.redhat_00001.1.el9sso
  • rh-sso7-keycloak red hat single sign on 7.6 18.0.7-1.redhat_00001.1.el8sso
  • rh-sso7-keycloak-server red hat single sign on 7.6 18.0.7-1.redhat_00001.1.el8sso
  • rh-sso7-keycloak red hat single sign on 7.6 18.0.7-1.redhat_00001.1.el7sso
  • rh-sso7-keycloak-server red hat single sign on 7.6 18.0.7-1.redhat_00001.1.el7sso

red hat advisories RHSA-2023:2707RHSA-2023:2706RHSA-2023:2705

Is CVE-2021-0341 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-0341 updated cvss 7.5

okhttp: information disclosure via improperly used cryptographic function

  • Red Hat Decision Manager 7 okhttp Red Hat Fuse 7 okhttp
    affected: no fix planned “Out of support scope”
  • Red Hat Integration Camel K 1 okhttp
    affected: no fix planned “Will not fix”
  • Red Hat Integration Camel Quarkus 1 okhttp
    affected: no fix available
  • Red Hat JBoss Enterprise Application Platform 7 okhttp
    affected: no fix planned “Will not fix”
  • Red Hat JBoss Fuse 6 okhttp Red Hat JBoss Fuse Service Works 6 okhttp
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Application Runtimes okhttp
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 3.11 jenkins-2-plugins
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4 jenkins-2-plugins
    affected: no fix planned “Will not fix”
show 12 more
  • Red Hat OpenShift Dev Spaces devspaces/idea-rhel8
    affected: no fix available
  • Red Hat Process Automation 7 okhttp
    affected: no fix planned “Out of support scope”
  • Red Hat Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8 7.6-22
    fixed: vendor fix RHSA-2023:2710
  • Red Hat AMQ Streams 2.4.0
    fixed: vendor fix RHSA-2023:3223
  • Red Hat Data Grid 8.4.2
    fixed: vendor fix RHSA-2023:2723
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
    fixed: vendor fix RHSA-2023:0756
  • Red Hat OpenShift Dev Spaces 3 devspaces/server-rhel8 3.16-14
    fixed: vendor fix RHSA-2024:6667
  • Red Hat Single Sign-On 7
    fixed: vendor fix RHSA-2023:2713
  • Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak 18.0.7-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server 18.0.7-1.redhat_00001.1.el7sso
    fixed: vendor fix RHSA-2023:2705
  • Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak 18.0.7-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server 18.0.7-1.redhat_00001.1.el8sso
    fixed: vendor fix RHSA-2023:2706
  • Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak 18.0.7-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server 18.0.7-1.redhat_00001.1.el9sso
    fixed: vendor fix RHSA-2023:2707
  • Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/elasticsearch6-rhel8 Red Hat AMQ Broker 7 okhttp Red Hat build of Apicurio Registry 2 okhttp Red Hat build of Quarkus okhttp Red Hat Enterprise Linux 8 log4j, log4j-jcl, log4j-web, log4j-slf4j Red Hat Enterprise Linux 9 log4j, log4j-jcl, log4j-slf4j
    +2 more products
    Red Hat JBoss Data Grid 6 okhttp Red Hat OpenShift Dev Spaces 3 devspaces/udi-rhel8 3.16-6, devspaces/idea-rhel8 3.16-3, devspaces/code-rhel8 3.16-20, devspaces/traefik-rhel8 3.16-2, devspaces/configbump-rhel8 3.16-4, devspaces/dashboard-rhel8 3.16-27, +6 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-24-074-07 updated cvss 7.5

Siemens SIMATIC

  • Siemens SIMATIC RF160B (6GT2003-0FA00) <V2.2
    affected: mitigation “Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.” siemens.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

0.92% chance of exploitation in the next 30 days, higher than 60% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
maven com.squareup.okhttp3:okhttp
<4.9.2
4.9.2

Affected products

  • n/a Android

Classification

Weakness
  • CWE-295 Improper Certificate Validation

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.