CVE-2020-11050 Improper Validation of Certificate with Host Mismatch in Java-WebSocket
Java-WebSocket library fails to validate SSL hostnames, allowing attackers to bypass certificate checks and potentially intercept or manipulate secure WebSocket communications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-11050?
CVE-2020-11050 is a critical vulnerability in TooTallNate Java-WebSocket, published on 7 May 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Java-WebSocket less than or equal to 1.4.1, there is an Improper Validation of Certificate with Host Mismatch where WebSocketClient does not perform SSL hostname validation. This has been patched in 1.5.0.
Which versions are affected by CVE-2020-11050?
2 open source packages ship an affected version, including org.java-websocket:Java-WebSocket. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.java-websocket:Java-WebSocket Maven | All versions | 1.5.0 |
org.java-websocket:Java-WebSocket Maven | All versions | 1.5.0 |
Products include Java-Websocket Project Java-Websocket.
How do I fix CVE-2020-11050?
Upgrade org.java-websocket:Java-WebSocket to 1.5.0 or later.
Is CVE-2020-11050 being exploited?
There is no known exploitation of CVE-2020-11050 in the wild and no public exploit code.
Sources
Also known as GHSA-gw55-jm4h-x339.