CVE-2016-2402
Description
From CVE.org
OkHttp before 2.7.4 and 3.x before 3.1.2 allows man-in-the-middle attackers to bypass certificate pinning by sending a certificate chain with a certificate from a non-pinned trusted CA and the pinned certificate.
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Understanding the Weakness (CWE)
Non-Repudiation
Technical Impact: Hide Activities
Exploitation of this flaw can lead to the trust of data that may have originated with a spoofed source.
Integrity,Confidentiality,Availability,Access Control
Technical Impact: Gain Privileges or Assume Identity; Execute Unauthorized Code or Commands
Data, requests, or actions taken by the attacking entity can be carried out as a spoofed benign entity.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
