Description

In Java-WebSocket less than or equal to 1.4.1, there is an Improper Validation of Certificate with Host Mismatch where WebSocketClient does not perform SSL hostname validation. This has been patched in 1.5.0.

Remediation

References

https://github.com/TooTallNate/Java-WebSocket/security/advisories/GHSA-gw55-jm4h-x339

Related Vulnerabilities

CVE-2018-1288 Vulnerability in maven package org.apache.kafka:kafka_2.11

CVE-2020-15168 Vulnerability in npm package node-fetch

CVE-2022-23080 Vulnerability in npm package directus

CVE-2021-27516 Vulnerability in npm package urijs

CVE-2022-36079 Vulnerability in npm package parse-server

Severity

Critical

Classification

CWE-295 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Third Party Advisory