CVE-2022-22885 Improper Certificate Validation in Hutool
Hutool's HttpRequest ignores TLS/SSL certificate validation, allowing attackers to perform man-in-the-middle attacks and intercept sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-22885?
CVE-2022-22885 is a critical vulnerability in n/a, published on 16 Feb 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Hutool v5.7.18's HttpRequest was discovered to ignore all TLS/SSL certificate validation.
Weakness: CWE-295
Which versions are affected by CVE-2022-22885?
2 open source packages ship an affected version, including cn.hutool:hutool-http. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
cn.hutool:hutool-http Maven | All versions | 5.7.19 |
cn.hutool:hutool-http Maven | All versions | 5.7.19 |
Products include Hutool Hutool.
How do I fix CVE-2022-22885?
Upgrade cn.hutool:hutool-http to 5.7.19 or later.
Is CVE-2022-22885 being exploited?
There is no known exploitation of CVE-2022-22885 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2023-42276 hutool Buffer Overflow vulnerability
- CVE-2023-42277 hutool Buffer Overflow vulnerability
- CVE-2023-24162 Dromara Hutool Deserialization of Untrusted Data vulnerability
- CVE-2023-24163 Dromara hutool vulnerable to SQL Injection
- CVE-2023-51075 hutool-core discovered to contain an infinite loop in the StrSplitter.splitByRegex function
Sources
Also known as GHSA-p7w9-8mxw-p3g7.