retrofit-2.9.0.jar: 3 vulnerabilities (highest severity is: 7.5) #4

Vulnerable Library - retrofit-2.9.0.jar

Found in HEAD commit: 453b4f59c6275cebe8f4768dc88dd854e7fc24fe

CVE-2021-0341

Vulnerable Library - okhttp-3.14.9.jar

An HTTP+HTTP/2 client for Android and Java applications

Library home page: https://github.com/square/okhttp

Dependency Hierarchy:

• retrofit-2.9.0.jar (Root Library)
  • ❌ okhttp-3.14.9.jar (Vulnerable Library)

Found in HEAD commit: 453b4f59c6275cebe8f4768dc88dd854e7fc24fe

Found in base branch: master

Vulnerability Details

In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-171980069

Publish Date: 2021-02-10

URL: CVE-2021-0341

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-3cqm-mf7h-prrj

Release Date: 2021-02-10

Fix Resolution: com.squareup.okhttp3:okhttp:4.9.2

CVE-2023-3635

Vulnerable Library - okio-1.17.2.jar

A modern I/O API for Java

Library home page: https://github.com/square/okio

Dependency Hierarchy:

• retrofit-2.9.0.jar (Root Library)
  • okhttp-3.14.9.jar
    • ❌ okio-1.17.2.jar (Vulnerable Library)

Found in HEAD commit: 453b4f59c6275cebe8f4768dc88dd854e7fc24fe

Found in base branch: master

Vulnerability Details

GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2023-07-12

URL: CVE-2023-3635

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-3635

Release Date: 2023-07-12

Fix Resolution (com.squareup.okio:okio): 1.17.6

Direct dependency fix Resolution (com.squareup.retrofit2:retrofit): 3.0.0

CVE-2023-0833

Vulnerable Library - okhttp-3.14.9.jar

An HTTP+HTTP/2 client for Android and Java applications

Library home page: https://github.com/square/okhttp

Dependency Hierarchy:

• retrofit-2.9.0.jar (Root Library)
  • ❌ okhttp-3.14.9.jar (Vulnerable Library)

Found in HEAD commit: 453b4f59c6275cebe8f4768dc88dd854e7fc24fe

Found in base branch: master

Vulnerability Details

A flaw was found in Red Hat's AMQ-Streams, which ships a version of the OKHttp component with an information disclosure flaw via an exception triggered by a header containing an illegal value. This issue could allow an authenticated attacker to access information outside of their regular permissions.

Publish Date: 2023-09-27

URL: CVE-2023-0833

CVSS 3 Score Details (4.7)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Release Date: 2023-09-27

Fix Resolution (com.squareup.okhttp3:okhttp): 4.9.2

Direct dependency fix Resolution (com.squareup.retrofit2:retrofit): 3.0.0