What is GHSA-3cqm-mf7h-prrj?

GHSA-3cqm-mf7h-prrj is a security advisory published by GitHub Security Advisories with High severity. Square OkHttp can accept the wrong certificate

Which CVE IDs does GHSA-3cqm-mf7h-prrj cover?

GHSA-3cqm-mf7h-prrj covers the following CVE IDs: CVE-2021-0341. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-3cqm-mf7h-prrj?

GHSA-3cqm-mf7h-prrj has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-3cqm-mf7h-prrj?

GHSA-3cqm-mf7h-prrj affects 1 product, including: maven/com.squareup.okhttp3:okhttp:\u003c 4.9.2.

GHSA-3cqm-mf7h-prrjHighCVSS 7.5

Square OkHttp can accept the wrong certificate

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

November 13, 2025

🔗 CVE IDs covered (1)

CVE-2021-0341 →

📋 Description

In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11 Android ID: A-171980069

🎯 Affected products1

maven/com.squareup.okhttp3:okhttp:< 4.9.2

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2021-0341
https://source.android.com/security/bulletin/2021-02-01
https://github.com/square/okhttp/issues/6724
https://github.com/square/okhttp/pull/6741
https://github.com/square/okhttp/commit/f574ea2f5259d9040f264ddeb582fb1ce563f10c
https://github.com/advisories/GHSA-3cqm-mf7h-prrj