Description
In Java-WebSocket less than or equal to 1.4.1, there is an Improper Validation of Certificate with Host Mismatch where WebSocketClient does not perform SSL hostname validation. This has been patched in 1.5.0.
Remediation
References
https://github.com/TooTallNate/Java-WebSocket/security/advisories/GHSA-gw55-jm4h-x339
Related Vulnerabilities
CVE-2016-10750 Vulnerability in maven package com.hazelcast:hazelcast-spring
CVE-2017-12160 Vulnerability in maven package org.keycloak:keycloak-services
CVE-2022-36901 Vulnerability in maven package org.jenkins-ci.plugins:http_request
CVE-2014-3623 Vulnerability in maven package org.apache.cxf:cxf-rt-ws-security