{"id":"ASB-A-171980069","details":"In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-171980069","CVE-2021-0341","GHSA-3cqm-mf7h-prrj"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2021-02-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2021-02-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/external/okhttp/+/ddc934efe3ed06ce34f3724d41cfbdcd7e7358fc"},{"type":"FIX","url":"https://android.googlesource.com/platform/libcore/+/4076be9a99bad5ff7651540df976c57462c3b8ce"}],"affected":[{"package":{"name":"platform/external/okhttp","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0:0"},{"fixed":"8.0:2021-02-01"}]}],"versions":["8.0"],"ecosystem_specific":{"severity":"High","spl":"2021-02-01","types":["ID"],"vanir_signatures":[{"digest":{"function_hash":"205612780247887574406662095825899160911","length":1172},"id":"ASB-A-171980069-4e0a0c07","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/okhttp/+/ddc934efe3ed06ce34f3724d41cfbdcd7e7358fc","target":{"file":"okhttp/src/main/java/com/squareup/okhttp/internal/tls/OkHostnameVerifier.java","function":"verifyHostName"},"deprecated":false},{"digest":{"length":340,"function_hash":"61535180085388431010717666557718059177"},"id":"ASB-A-171980069-519b8473","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/okhttp/+/ddc934efe3ed06ce34f3724d41cfbdcd7e7358fc","target":{"file":"repackaged/okhttp/src/main/java/com/android/okhttp/internal/tls/OkHostnameVerifier.java","function":"verifyHostName"},"deprecated":false},{"source":"https://android.googlesource.com/platform/external/okhttp/+/ddc934efe3ed06ce34f3724d41cfbdcd7e7358fc","target":{"function":"verifyHostName","file":"okhttp/src/main/java/com/squareup/okhttp/internal/tls/OkHostnameVerifier.java"},"deprecated":false,"digest":{"function_hash":"61535180085388431010717666557718059177","length":340},"id":"ASB-A-171980069-77b35de2","signature_type":"Function","signature_version":"v1"},{"digest":{"line_hashes":["133244152640812713275770336114416831433","67592987695279721687733199410590096876","25291247337675201734748419012761023160","207802613743572584816161990863362891210","113237312858454232655678767831191925576","289357571628723008831098994338509046514","44963732600006155219942966911031120165","105135349804760838859480469610730392589","102715412356406950219770955940244365114"],"threshold":0.9},"id":"ASB-A-171980069-9e08ce53","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/okhttp/+/ddc934efe3ed06ce34f3724d41cfbdcd7e7358fc","target":{"file":"okhttp/src/main/java/com/squareup/okhttp/internal/tls/OkHostnameVerifier.java"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/okhttp/+/ddc934efe3ed06ce34f3724d41cfbdcd7e7358fc","target":{"file":"repackaged/okhttp/src/main/java/com/android/okhttp/internal/tls/OkHostnameVerifier.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["133244152640812713275770336114416831433","67592987695279721687733199410590096876","25291247337675201734748419012761023160","207802613743572584816161990863362891210","113237312858454232655678767831191925576","289357571628723008831098994338509046514","44963732600006155219942966911031120165","105135349804760838859480469610730392589","102715412356406950219770955940244365114"]},"id":"ASB-A-171980069-b85ee56f"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/okhttp/+/ddc934efe3ed06ce34f3724d41cfbdcd7e7358fc","target":{"file":"repackaged/okhttp/src/main/java/com/android/okhttp/internal/tls/OkHostnameVerifier.java","function":"verifyHostName"},"deprecated":false,"digest":{"function_hash":"205612780247887574406662095825899160911","length":1172},"id":"ASB-A-171980069-dd878d61"}],"fixes":["https://android.googlesource.com/platform/external/okhttp/+/ddc934efe3ed06ce34f3724d41cfbdcd7e7358fc"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-171980069.json"}},{"package":{"name":"platform/libcore","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0:0"},{"fixed":"8.0:2021-02-01"}]}],"versions":["8.0"],"ecosystem_specific":{"spl":"2021-02-01","types":["ID"],"fixes":["https://android.googlesource.com/platform/libcore/+/4076be9a99bad5ff7651540df976c57462c3b8ce"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-171980069.json"}},{"package":{"name":"platform/external/okhttp","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1:0"},{"fixed":"8.1:2021-02-01"}]}],"versions":["8.1"],"ecosystem_specific":{"vanir_signatures":[{"target":{"function":"verifyHostName","file":"repackaged/okhttp/src/main/java/com/android/okhttp/internal/tls/OkHostnameVerifier.java"},"deprecated":false,"digest":{"function_hash":"205612780247887574406662095825899160911","length":1172},"id":"ASB-A-171980069-18c5bc20","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/okhttp/+/ddc934efe3ed06ce34f3724d41cfbdcd7e7358fc"},{"deprecated":false,"digest":{"function_hash":"61535180085388431010717666557718059177","length":340},"id":"ASB-A-171980069-2745e397","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/okhttp/+/ddc934efe3ed06ce34f3724d41cfbdcd7e7358fc","target":{"function":"verifyHostName","file":"repackaged/okhttp/src/main/java/com/android/okhttp/internal/tls/OkHostnameVerifier.java"}},{"target":{"file":"okhttp/src/main/java/com/squareup/okhttp/internal/tls/OkHostnameVerifier.java"},"deprecated":false,"digest":{"line_hashes":["133244152640812713275770336114416831433","67592987695279721687733199410590096876","25291247337675201734748419012761023160","207802613743572584816161990863362891210","113237312858454232655678767831191925576","289357571628723008831098994338509046514","44963732600006155219942966911031120165","105135349804760838859480469610730392589","102715412356406950219770955940244365114"],"threshold":0.9},"id":"ASB-A-171980069-3c6995ef","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/okhttp/+/ddc934efe3ed06ce34f3724d41cfbdcd7e7358fc"},{"deprecated":false,"digest":{"line_hashes":["133244152640812713275770336114416831433","67592987695279721687733199410590096876","25291247337675201734748419012761023160","207802613743572584816161990863362891210","113237312858454232655678767831191925576","289357571628723008831098994338509046514","44963732600006155219942966911031120165","105135349804760838859480469610730392589","102715412356406950219770955940244365114"],"threshold":0.9},"id":"ASB-A-171980069-6d59cb11","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/okhttp/+/ddc934efe3ed06ce34f3724d41cfbdcd7e7358fc","target":{"file":"repackaged/okhttp/src/main/java/com/android/okhttp/internal/tls/OkHostnameVerifier.java"}},{"deprecated":false,"digest":{"function_hash":"61535180085388431010717666557718059177","length":340},"id":"ASB-A-171980069-85ac6663","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/okhttp/+/ddc934efe3ed06ce34f3724d41cfbdcd7e7358fc","target":{"file":"okhttp/src/main/java/com/squareup/okhttp/internal/tls/OkHostnameVerifier.java","function":"verifyHostName"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/external/okhttp/+/ddc934efe3ed06ce34f3724d41cfbdcd7e7358fc","target":{"file":"okhttp/src/main/java/com/squareup/okhttp/internal/tls/OkHostnameVerifier.java","function":"verifyHostName"},"deprecated":false,"digest":{"function_hash":"205612780247887574406662095825899160911","length":1172},"id":"ASB-A-171980069-a90c38c9","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/external/okhttp/+/ddc934efe3ed06ce34f3724d41cfbdcd7e7358fc"],"severity":"High","spl":"2021-02-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-171980069.json"}},{"package":{"name":"platform/libcore","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1:0"},{"fixed":"8.1:2021-02-01"}]}],"versions":["8.1"],"ecosystem_specific":{"severity":"High","spl":"2021-02-01","types":["ID"],"fixes":["https://android.googlesource.com/platform/libcore/+/4076be9a99bad5ff7651540df976c57462c3b8ce"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-171980069.json"}},{"package":{"name":"platform/external/okhttp","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9:0"},{"fixed":"9:2021-02-01"}]}],"versions":["9"],"ecosystem_specific":{"spl":"2021-02-01","types":["ID"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/external/okhttp/+/ddc934efe3ed06ce34f3724d41cfbdcd7e7358fc","target":{"file":"okhttp/src/main/java/com/squareup/okhttp/internal/tls/OkHostnameVerifier.java"},"deprecated":false,"digest":{"line_hashes":["133244152640812713275770336114416831433","67592987695279721687733199410590096876","25291247337675201734748419012761023160","207802613743572584816161990863362891210","113237312858454232655678767831191925576","289357571628723008831098994338509046514","44963732600006155219942966911031120165","105135349804760838859480469610730392589","102715412356406950219770955940244365114"],"threshold":0.9},"id":"ASB-A-171980069-22805d13","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/external/okhttp/+/ddc934efe3ed06ce34f3724d41cfbdcd7e7358fc","target":{"file":"repackaged/okhttp/src/main/java/com/android/okhttp/internal/tls/OkHostnameVerifier.java","function":"verifyHostName"},"deprecated":false,"digest":{"function_hash":"205612780247887574406662095825899160911","length":1172},"id":"ASB-A-171980069-393297a3","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/okhttp/+/ddc934efe3ed06ce34f3724d41cfbdcd7e7358fc","target":{"file":"repackaged/okhttp/src/main/java/com/android/okhttp/internal/tls/OkHostnameVerifier.java","function":"verifyHostName"},"deprecated":false,"digest":{"function_hash":"61535180085388431010717666557718059177","length":340},"id":"ASB-A-171980069-7165c09f"},{"digest":{"length":340,"function_hash":"61535180085388431010717666557718059177"},"id":"ASB-A-171980069-c5910a7b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/okhttp/+/ddc934efe3ed06ce34f3724d41cfbdcd7e7358fc","target":{"file":"okhttp/src/main/java/com/squareup/okhttp/internal/tls/OkHostnameVerifier.java","function":"verifyHostName"},"deprecated":false},{"digest":{"line_hashes":["133244152640812713275770336114416831433","67592987695279721687733199410590096876","25291247337675201734748419012761023160","207802613743572584816161990863362891210","113237312858454232655678767831191925576","289357571628723008831098994338509046514","44963732600006155219942966911031120165","105135349804760838859480469610730392589","102715412356406950219770955940244365114"],"threshold":0.9},"id":"ASB-A-171980069-d6b58535","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/okhttp/+/ddc934efe3ed06ce34f3724d41cfbdcd7e7358fc","target":{"file":"repackaged/okhttp/src/main/java/com/android/okhttp/internal/tls/OkHostnameVerifier.java"},"deprecated":false},{"id":"ASB-A-171980069-f53ce736","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/okhttp/+/ddc934efe3ed06ce34f3724d41cfbdcd7e7358fc","target":{"file":"okhttp/src/main/java/com/squareup/okhttp/internal/tls/OkHostnameVerifier.java","function":"verifyHostName"},"deprecated":false,"digest":{"function_hash":"205612780247887574406662095825899160911","length":1172}}],"fixes":["https://android.googlesource.com/platform/external/okhttp/+/ddc934efe3ed06ce34f3724d41cfbdcd7e7358fc"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-171980069.json"}},{"package":{"name":"platform/libcore","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9:0"},{"fixed":"9:2021-02-01"}]}],"versions":["9"],"ecosystem_specific":{"types":["ID"],"fixes":["https://android.googlesource.com/platform/libcore/+/4076be9a99bad5ff7651540df976c57462c3b8ce"],"severity":"High","spl":"2021-02-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-171980069.json"}},{"package":{"name":"platform/external/okhttp","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2021-02-01"}]}],"versions":["10"],"ecosystem_specific":{"types":["ID"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/okhttp/+/ddc934efe3ed06ce34f3724d41cfbdcd7e7358fc","target":{"file":"okhttp/src/main/java/com/squareup/okhttp/internal/tls/OkHostnameVerifier.java","function":"verifyHostName"},"deprecated":false,"digest":{"length":1172,"function_hash":"205612780247887574406662095825899160911"},"id":"ASB-A-171980069-6eb640d2"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/okhttp/+/ddc934efe3ed06ce34f3724d41cfbdcd7e7358fc","target":{"file":"okhttp/src/main/java/com/squareup/okhttp/internal/tls/OkHostnameVerifier.java","function":"verifyHostName"},"deprecated":false,"digest":{"function_hash":"61535180085388431010717666557718059177","length":340},"id":"ASB-A-171980069-813f9277"},{"id":"ASB-A-171980069-a78101d6","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/okhttp/+/ddc934efe3ed06ce34f3724d41cfbdcd7e7358fc","target":{"file":"repackaged/okhttp/src/main/java/com/android/okhttp/internal/tls/OkHostnameVerifier.java"},"deprecated":false,"digest":{"line_hashes":["133244152640812713275770336114416831433","67592987695279721687733199410590096876","25291247337675201734748419012761023160","207802613743572584816161990863362891210","113237312858454232655678767831191925576","289357571628723008831098994338509046514","44963732600006155219942966911031120165","105135349804760838859480469610730392589","102715412356406950219770955940244365114"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/okhttp/+/ddc934efe3ed06ce34f3724d41cfbdcd7e7358fc","target":{"file":"repackaged/okhttp/src/main/java/com/android/okhttp/internal/tls/OkHostnameVerifier.java","function":"verifyHostName"},"deprecated":false,"digest":{"function_hash":"205612780247887574406662095825899160911","length":1172},"id":"ASB-A-171980069-a923aa93"},{"deprecated":false,"digest":{"line_hashes":["133244152640812713275770336114416831433","67592987695279721687733199410590096876","25291247337675201734748419012761023160","207802613743572584816161990863362891210","113237312858454232655678767831191925576","289357571628723008831098994338509046514","44963732600006155219942966911031120165","105135349804760838859480469610730392589","102715412356406950219770955940244365114"],"threshold":0.9},"id":"ASB-A-171980069-bfdf11a1","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/okhttp/+/ddc934efe3ed06ce34f3724d41cfbdcd7e7358fc","target":{"file":"okhttp/src/main/java/com/squareup/okhttp/internal/tls/OkHostnameVerifier.java"}},{"source":"https://android.googlesource.com/platform/external/okhttp/+/ddc934efe3ed06ce34f3724d41cfbdcd7e7358fc","target":{"function":"verifyHostName","file":"repackaged/okhttp/src/main/java/com/android/okhttp/internal/tls/OkHostnameVerifier.java"},"deprecated":false,"digest":{"length":340,"function_hash":"61535180085388431010717666557718059177"},"id":"ASB-A-171980069-d00ee06c","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/external/okhttp/+/ddc934efe3ed06ce34f3724d41cfbdcd7e7358fc"],"severity":"High","spl":"2021-02-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-171980069.json"}},{"package":{"name":"platform/libcore","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2021-02-01"}]}],"versions":["10"],"ecosystem_specific":{"types":["ID"],"fixes":["https://android.googlesource.com/platform/libcore/+/4076be9a99bad5ff7651540df976c57462c3b8ce"],"severity":"High","spl":"2021-02-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-171980069.json"}},{"package":{"name":"platform/external/okhttp","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2021-02-01"}]}],"versions":["11"],"ecosystem_specific":{"severity":"High","spl":"2021-02-01","types":["ID"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/external/okhttp/+/ddc934efe3ed06ce34f3724d41cfbdcd7e7358fc","target":{"file":"repackaged/okhttp/src/main/java/com/android/okhttp/internal/tls/OkHostnameVerifier.java","function":"verifyHostName"},"deprecated":false,"digest":{"length":340,"function_hash":"61535180085388431010717666557718059177"},"id":"ASB-A-171980069-5ff67caa","signature_type":"Function"},{"source":"https://android.googlesource.com/platform/external/okhttp/+/ddc934efe3ed06ce34f3724d41cfbdcd7e7358fc","target":{"file":"okhttp/src/main/java/com/squareup/okhttp/internal/tls/OkHostnameVerifier.java","function":"verifyHostName"},"deprecated":false,"digest":{"function_hash":"205612780247887574406662095825899160911","length":1172},"id":"ASB-A-171980069-a32e75c0","signature_type":"Function","signature_version":"v1"},{"id":"ASB-A-171980069-b911c268","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/okhttp/+/ddc934efe3ed06ce34f3724d41cfbdcd7e7358fc","target":{"file":"okhttp/src/main/java/com/squareup/okhttp/internal/tls/OkHostnameVerifier.java"},"deprecated":false,"digest":{"line_hashes":["133244152640812713275770336114416831433","67592987695279721687733199410590096876","25291247337675201734748419012761023160","207802613743572584816161990863362891210","113237312858454232655678767831191925576","289357571628723008831098994338509046514","44963732600006155219942966911031120165","105135349804760838859480469610730392589","102715412356406950219770955940244365114"],"threshold":0.9}},{"target":{"file":"okhttp/src/main/java/com/squareup/okhttp/internal/tls/OkHostnameVerifier.java","function":"verifyHostName"},"deprecated":false,"digest":{"function_hash":"61535180085388431010717666557718059177","length":340},"id":"ASB-A-171980069-d96fdd6a","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/okhttp/+/ddc934efe3ed06ce34f3724d41cfbdcd7e7358fc"},{"target":{"file":"repackaged/okhttp/src/main/java/com/android/okhttp/internal/tls/OkHostnameVerifier.java"},"deprecated":false,"digest":{"line_hashes":["133244152640812713275770336114416831433","67592987695279721687733199410590096876","25291247337675201734748419012761023160","207802613743572584816161990863362891210","113237312858454232655678767831191925576","289357571628723008831098994338509046514","44963732600006155219942966911031120165","105135349804760838859480469610730392589","102715412356406950219770955940244365114"],"threshold":0.9},"id":"ASB-A-171980069-f467dd0f","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/okhttp/+/ddc934efe3ed06ce34f3724d41cfbdcd7e7358fc"},{"id":"ASB-A-171980069-f9864994","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/okhttp/+/ddc934efe3ed06ce34f3724d41cfbdcd7e7358fc","target":{"file":"repackaged/okhttp/src/main/java/com/android/okhttp/internal/tls/OkHostnameVerifier.java","function":"verifyHostName"},"deprecated":false,"digest":{"function_hash":"205612780247887574406662095825899160911","length":1172}}],"fixes":["https://android.googlesource.com/platform/external/okhttp/+/ddc934efe3ed06ce34f3724d41cfbdcd7e7358fc"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-171980069.json"}},{"package":{"name":"platform/libcore","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2021-02-01"}]}],"versions":["11"],"ecosystem_specific":{"types":["ID"],"fixes":["https://android.googlesource.com/platform/libcore/+/4076be9a99bad5ff7651540df976c57462c3b8ce"],"severity":"High","spl":"2021-02-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-171980069.json"}}],"schema_version":"1.9.0"}