Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.java-websocket:Java-WebSocket

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.0MavenPublished

    Improper Validation of Certificate with Host Mismatch in Java-WebSocket

    CVE-2020-11050 · GHSA-gw55-jm4h-x339

    Affected
    • Maven org.java-websocket:Java-WebSocket <= 1.4.1
    Fixed in
    1.5.0· Vendor fix available
    Issue
    The Java-WebSocket Client does not perform hostname verification. - This means that SSL certificates of other hosts are accepted as long as they are trusted. To exploit this vulnerability an attacker has to perform a man-in-the-middle (MITM) attack between a Java application using the Java-WebSocket Client and an WebSocket server it's connecting to. - TLS normally protects users and systems against MITM attacks, it cannot if certificates from other trusted hosts are accepted by the client. For more information see: CWE-297: Improper Validation of Certificate with Host Mismatch - https://cwe.mitre.org/data/definitions/297.html Important note The OWASP Dependency-Check (https://jeremylong.github.io/DependencyCheck/index.html) may report that a dependency of your project is affected by this security vulnerability, but you don't use this lib. This is caused by the fuzzy search in the OWASP implementation. Check out this issue…

    Recommended action: Upgrade to 1.5.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →