CVE-2018-20200 Security feature bypass in n/a
Attackers can bypass certificate pinning in OkHttp by hooking the application to modify SSLContext, enabling man-in-the-middle attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-20200?
CVE-2018-20200 is a medium-severity vulnerability in n/a, published on 18 Apr 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CertificatePinner.java in OkHttp 3.x through 3.12.0 allows man-in-the-middle attackers to bypass certificate pinning by changing SSLContext and the boolean values while hooking the application. NOTE: This id is disputed because some parties don't consider this is a vulnerability. Their rationale can be found in https://github.com/square/okhttp/issues/4967
Weakness: CWE-295
Which versions are affected by CVE-2018-20200?
It affects 1 product.
Products include Squareup Okhttp.
How do I fix CVE-2018-20200?
No fix published yet.
Is CVE-2018-20200 being exploited?
There is no known exploitation of CVE-2018-20200 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as CLEANSTART-2026-WW06581, GHSA-qvh7-2qrg-6v75.