Description

Hutool v5.7.18's HttpRequest was discovered to ignore all TLS/SSL certificate validation.

Remediation

References

https://apidoc.gitee.com/dromara/hutool/cn/hutool/http/ssl/DefaultSSLInfo.html

https://github.com/dromara/hutool/issues/2042

Related Vulnerabilities

CVE-2018-20821 Vulnerability in maven package org.webjars.npm:node-sass

CVE-2021-23784 Vulnerability in npm package tempura

CVE-2019-17566 Vulnerability in maven package org.apache.xmlgraphics:batik-svgrasterizer

CVE-2017-5653 Vulnerability in maven package org.apache.cxf:cxf-rt-rs-security-xml

CVE-2014-10067 Vulnerability in npm package paypal-ipn

Severity

Critical

Classification

CWE-295 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Third Party Advisory Exploit Issue Tracking