Improper Validation of Certificate with Host Mismatch in Java-WebSocket
CVE-2020-11050

9CRITICAL

Key Information:

Vendor: Tootallnate
Status: Java-websocket
Vendor: CVE Published:; 7 May 2020

🔔 Create Tootallnate Vulnerability Alert

What is CVE-2020-11050?

In Java-WebSocket less than or equal to 1.4.1, there is an Improper Validation of Certificate with Host Mismatch where WebSocketClient does not perform SSL hostname validation. This has been patched in 1.5.0.

Affected Version(s)

Java-WebSocket <= 1.4.1

References

https://github.com/TooTallNate/Java-WebSocket/security/ad...

x_refsource_CONFIRM

CVSS V3.1

Score:

Severity:

CRITICAL

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

High

Privileges Required:

None

User Interaction:

None

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
May 7, 2020
Vulnerability Reserved
Mar 30, 2020

CVE-2020-11050 Data

JSON