Description

Hutool v5.7.18's HttpRequest was discovered to ignore all TLS/SSL certificate validation.

Remediation

References

https://apidoc.gitee.com/dromara/hutool/cn/hutool/http/ssl/DefaultSSLInfo.html

https://github.com/dromara/hutool/issues/2042

Related Vulnerabilities

CVE-2022-38723 Vulnerability in maven package io.gravitee.apim.rest.api:gravitee-apim-rest-api-service

CVE-2019-10341 Vulnerability in maven package io.jenkins.docker:docker-plugin

CVE-2021-4040 Vulnerability in maven package org.apache.activemq:artemis-core-client

CVE-2019-1003085 Vulnerability in maven package org.jenkins-ci.plugins:zephyr-enterprise-test-management

CVE-2016-2175 Vulnerability in maven package org.apache.pdfbox:jempbox

Severity

Critical

Classification

CWE-295 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Third Party Advisory Exploit Issue Tracking