search

OSSIndex / vulns

Report missing advisories and corrections on OSS Index
17 stars 12 forks source link

Incorrect vulnerability details: CVE-2021-0341 - com.squareup.okhttp3:okhttp #296

Closed bykes closed 1 year ago

bykes commented 2 years ago

Vulnerability URL Provide the URL to the vulnerability. For example:

https://ossindex.sonatype.org/vulnerability/CVE-2021-0341

Component URL Provide the URL to the component. For example:

https://ossindex.sonatype.org/component/pkg:maven/com.squareup.okhttp3/okhttp

Description CVE-2021-0341 is reported as vulnerability in version 4.10.0 This was already fixed in that version - https://github.com/square/okhttp/issues/6724 See https://github.com/square/okhttp/blob/parent-4.10.0/okhttp/src/main/kotlin/okhttp3/internal/tls/OkHostnameVerifier.kt The history contain Cherry pick fix for CVE-2021-0341 onto 4.9.x #6741 See https://github.com/square/okhttp/pull/6741/files for detail fix.

bykes commented 2 years ago

when we can expect a fix for this?

ken-duck commented 2 years ago

Sorry for the delay. We have been working on getting appropriate internal processes defined for dealing with data issues in the new data set. We are now working on catching up on the backlog.

This issue has been passed to the research team on our internal tracking system, and I will report back here once more is known.

ken-duck commented 1 year ago

Fixed: https://ossindex.sonatype.org/component/pkg:maven/com.squareup.okhttp3/okhttp@4.10.0