{"id":"GHSA-8mx3-gp3p-vgg7","summary":"kevinsawicki/http-request Missing certificate validation","details":"OSS Http Request (kevinsawicki/http-request) is missing SSL/TLS certificate validation. The impact is: certificate spoofing. The component is: use this library when https communication. The attack vector is: certificate spoofing.","aliases":["CVE-2019-1010206"],"modified":"2024-02-16T08:01:28.931303Z","published":"2022-05-24T22:00:16Z","database_specific":{"nvd_published_at":"2019-07-23T14:15:00Z","cwe_ids":["CWE-295"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2022-11-03T23:47:08Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010206"},{"type":"WEB","url":"https://github.com/kevinsawicki/http-request/blob/master/lib/src/main/java/com/github/kevinsawicki/http/HttpRequest.java"}],"affected":[{"package":{"name":"com.github.kevinsawicki:http-request","ecosystem":"Maven","purl":"pkg:maven/com.github.kevinsawicki/http-request"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.0"}]}],"versions":["0.1","0.2","0.3","0.4","0.5","0.6","0.7","0.8","0.9","0.9.1","1.0","1.1","2.0","2.1","2.2","3.0","3.1","4.0","4.1","4.2","5.0","5.1","5.2","5.3","5.4","5.4.1","5.5","5.6","6.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-8mx3-gp3p-vgg7/GHSA-8mx3-gp3p-vgg7.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}