Improper Certificate Validation in Google Android - CVE-2021-0341

Vulnerability identifier: #VU72323

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-0341

CWE-ID: CWE-295

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform MitM attack.

the vulnerability exists due to improper certificate validation within the verifyHostName in OkHostnameVerifier.java in okhttp library in Android runtime. A remote attacker can force the system to accept a certificate for the wrong domain due to improperly used crypto and perform MitM attack.

Google Android
DataStage on Cloud Pak for Data
Business Automation Insights
Red Hat Single Sign-On
Oracle Access Manager
JBoss Data Grid
Jira Software Server
Jira Software Data Center
Jira Service Management Data Center
IBM Cloud Transformation Advisor
Red Hat OpenShift Dev Spaces
IBM Cloud Pak for Business Automation
Oracle Communications Cloud Native Core Policy
AMQ Streams
JBoss Enterprise Application Platform expansion pack (EAP XP)
rh-sso7-keycloak (Red Hat package)

Install updates from vendor's website.

Google Android - addressed in versions 8.1 2021-02-01, 9 2021-02-01, 10 2021-02-01, 11 2021-02-01
DataStage on Cloud Pak for Data - update to 5.2.0
Red Hat Single Sign-On - update to 7.6.3
JBoss Data Grid - update to 8.4.2
Jira Software Server - addressed in versions 9.12.33, 10.3.16
Jira Software Data Center - addressed in versions 9.12.33, 10.3.16
Jira Service Management Data Center - update to 10.3.16
AMQ Streams - update to 2.4.0
IBM Cloud Transformation Advisor - update to 3.10.0
Red Hat OpenShift Dev Spaces - update to 3.16.0
JBoss Enterprise Application Platform expansion pack (EAP XP) - update to 4.0.0
rh-sso7-keycloak (Red Hat package) - addressed in versions 18.0.7-1.redhat_00001.1.el7sso, 18.0.7-1.redhat_00001.1.el8sso, 18.0.7-1.redhat_00001.1.el9sso
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3-IF035, 24.0.0-IF001
Business Automation Insights - update to 24.0.0.0.1

• https://source.android.com/security/bulletin/2021-02-01
• https://android.googlesource.com/platform/external/okhttp/+/ddc934efe3ed06ce34f3724d41cfbdcd7e7358fc
• https://android.googlesource.com/platform/libcore/+/4076be9a99bad5ff7651540df976c57462c3b8ce
• https://bugzilla.redhat.com/show_bug.cgi?id=2154086

• Multiple vulnerabilities in JBoss EAP XP
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 9
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 8
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 7
• Red Hat Data Grid 8.4 update for okhttp
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for OpenShift
• Multiple vulnerabilities in Red Hat AMQ Streams 2.4
• Multiple vulnerabilities in Oracle Access Manager
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in Red Hat OpenShift Dev Spaces
• Multiple vulnerabilities in IBM Business Automation Insights
• IBM DataStage on Cloud Pak for Data update for OkHostnameVerifier.java package
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Policy
• Jira Software Data Center and Server update for okhttp
• Jira Service Management Data Center and Server update for okhttp