{"id":"CVE-2021-0341","aliases":["A-171980069","ASB-A-171980069","CLSA-2025-1766707708","EUVD-2021-2960","GHSA-3cqm-mf7h-prrj","RHSA-2023:2705","RHSA-2023:2706","RHSA-2023:2707","ROOT-APP-MAVEN-CVE-2021-0341"],"status":"published","title":"Square OkHttp can accept the wrong certificate","description":"In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-171980069","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00915,"percentile":0.60583,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2021-02-01T00:00:00Z","modified":"2026-11-05T16:32:28Z","fixes":[{"ecosystem":"Maven","package":"com.squareup.okhttp3:okhttp","fixed_in":["4.9.2"],"sources":["ghsa","osv"]},{"ecosystem":"Android","package":"platform/external/okhttp","fixed_in":["8.0:2021-02-01","8.1:2021-02-01","9:2021-02-01","10:2021-02-01","11:2021-02-01"],"sources":["osv"]},{"ecosystem":"Android","package":"platform/libcore","fixed_in":["8.0:2021-02-01","8.1:2021-02-01","9:2021-02-01","10:2021-02-01","11:2021-02-01"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"com.squareup.okhttp3:okhttp","fixed_in":["3.14.9-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"com.squareup.okhttp3:okhttp","fixed_in":["3.14.9-aikido.1","4.6.0-aikido.1","3.14.9-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.com.squareup.okhttp3:okhttp","fixed_in":["3.14.9-root.io.1","4.6.0-root.io.1","3.14.9-root.io.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.squareup.okhttp3:okhttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.2"}]}]},{"source":"osv","ecosystem":"Android","package":"platform/external/okhttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0:0"},{"fixed":"8.0:2021-02-01"}]}],"versions":["8.0"]},{"source":"osv","ecosystem":"Android","package":"platform/libcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0:0"},{"fixed":"8.0:2021-02-01"}]}],"versions":["8.0"]},{"source":"osv","ecosystem":"Android","package":"platform/external/okhttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1:0"},{"fixed":"8.1:2021-02-01"}]}],"versions":["8.1"]},{"source":"osv","ecosystem":"Android","package":"platform/libcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1:0"},{"fixed":"8.1:2021-02-01"}]}],"versions":["8.1"]},{"source":"osv","ecosystem":"Android","package":"platform/external/okhttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9:0"},{"fixed":"9:2021-02-01"}]}],"versions":["9"]},{"source":"osv","ecosystem":"Android","package":"platform/libcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9:0"},{"fixed":"9:2021-02-01"}]}],"versions":["9"]},{"source":"osv","ecosystem":"Android","package":"platform/external/okhttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2021-02-01"}]}],"versions":["10"]},{"source":"osv","ecosystem":"Android","package":"platform/libcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2021-02-01"}]}],"versions":["10"]},{"source":"osv","ecosystem":"Android","package":"platform/external/okhttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2021-02-01"}]}],"versions":["11"]},{"source":"osv","ecosystem":"Android","package":"platform/libcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2021-02-01"}]}],"versions":["11"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.squareup.okhttp3:okhttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.14.9"},{"fixed":"3.14.9-tuxcare.1"}]}],"versions":["3.14.9"]},{"source":"osv","ecosystem":"Maven","package":"com.squareup.okhttp3:okhttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.2"}]}],"versions":["3.0.0","3.0.0-RC1","3.0.1","3.1.0","3.1.1","3.1.2","3.10.0","3.11.0","3.12.0","3.12.1","3.12.10","3.12.11","3.12.12","3.12.13","3.12.2","3.12.3","3.12.4","3.12.5","3.12.6","3.12.7","3.12.8","3.12.9","3.13.0","3.13.1","3.14.0","3.14.1","3.14.2","3.14.3","3.14.4","3.14.5","3.14.6","3.14.7","3.14.8","3.14.9","3.2.0","3.3.0","3.3.1","3.4.0","3.4.0-RC1","3.4.1","3.4.2","3.5.0","3.6.0","3.7.0","3.8.0","3.8.1","3.9.0","3.9.1","4.0.0","4.0.0-RC1","4.0.0-RC2","4.0.0-RC3","4.0.0-alpha01","4.0.0-alpha02","4.0.1","4.1.0","4.1.1","4.2.0","4.2.1","4.2.2","4.3.0","4.3.1","4.4.0","4.4.1","4.5.0","4.5.0-RC1","4.6.0","4.7.0","4.7.1","4.7.2","4.8.0","4.8.1","4.9.0","4.9.1"]},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.6::el7","package":"rh-sso7-keycloak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.0.7-1.redhat_00001.1.el7sso"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.6::el7","package":"rh-sso7-keycloak-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.0.7-1.redhat_00001.1.el7sso"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.6::el8","package":"rh-sso7-keycloak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.0.7-1.redhat_00001.1.el8sso"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.6::el8","package":"rh-sso7-keycloak-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.0.7-1.redhat_00001.1.el8sso"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.6::el9","package":"rh-sso7-keycloak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.0.7-1.redhat_00001.1.el9sso"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.6::el9","package":"rh-sso7-keycloak-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.0.7-1.redhat_00001.1.el9sso"}]}],"bundled":7},{"source":"osv","ecosystem":"Root:Maven","package":"com.squareup.okhttp3:okhttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.9-aikido.1"},{"fixed":"4.6.0-aikido.1"},{"fixed":"3.14.9-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.com.squareup.okhttp3:okhttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.9-root.io.1"},{"fixed":"4.6.0-root.io.1"},{"fixed":"3.14.9-root.io.2"}]}]}],"products":[{"vendor":"google","product":"android"}],"references":[{"url":"https://source.android.com/security/bulletin/2021-02-01","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","advisory","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-0341","tags":["advisory"]},{"url":"https://github.com/square/okhttp/issues/6724","tags":["web"]},{"url":"https://github.com/square/okhttp/pull/6741","tags":["web"]},{"url":"https://github.com/square/okhttp/commit/f574ea2f5259d9040f264ddeb582fb1ce563f10c","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3cqm-mf7h-prrj"},{"url":"https://android.googlesource.com/platform/external/okhttp/+/ddc934efe3ed06ce34f3724d41cfbdcd7e7358fc","tags":["fix"]},{"url":"https://android.googlesource.com/platform/libcore/+/4076be9a99bad5ff7651540df976c57462c3b8ce","tags":["fix"]},{"url":"https://github.com/square/okhttp","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2023:2705","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2129710","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2151988","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2153260","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2153379","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2154086","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2158916","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2166004","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2705.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-0341","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-0341","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-4492","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-4492","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-4492","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-38752","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-38752","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-38752","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-41854","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-41854","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41854","tags":["advisory"]},{"url":"https://bitbucket.org/snakeyaml/snakeyaml/issues/543/stackoverflow-oss-fuzz-50355","tags":["article"]},{"url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50355","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-41881","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-41881","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41881","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-45787","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-45787","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45787","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-0482","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-0482","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0482","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:2706","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2706.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:2707","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2707.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-0341","description":"In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-171980069","status":"published","published":"2021-02-10T16:50:15Z","modified":"2024-08-03T15:40:00.192Z","updated_at":"2026-11-02T14:33:10.555814Z"}],"euvd":[{"id":"EUVD-2021-2960","description":"In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-171980069","status":"published","published":"2021-02-10T16:50:15Z","modified":"2024-08-03T15:40:00Z","updated_at":"2026-11-03T03:25:17.997367Z"}],"ghsa":[{"id":"GHSA-3cqm-mf7h-prrj","title":"Square OkHttp can accept the wrong certificate","description":"In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11 Android ID: A-171980069","status":"published","published":"2022-05-24T17:41:45Z","modified":"2025-11-13T16:34:08Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:39:07.985215Z"}],"nvd":[{"id":"CVE-2021-0341","description":"In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-171980069","status":"published","published":"2021-02-10T17:15:22.037Z","modified":"2026-06-17T03:29:49.4Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:06:50.031227Z"}],"osv":[{"id":"GHSA-3cqm-mf7h-prrj","title":"Square OkHttp can accept the wrong certificate","description":"In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11 Android ID: A-171980069","status":"published","published":"2022-05-24T17:41:45Z","modified":"2026-09-10T03:49:29.393060511Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:46:35.406455Z"},{"id":"RHSA-2023:2705","title":"Red Hat Security Advisory: Red Hat Single Sign-On 7.6.3 security update on RHEL 7","status":"published","published":"2024-09-30T16:26:07Z","modified":"2026-10-13T10:04:12Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:2706","title":"Red Hat Security Advisory: Red Hat Single Sign-On 7.6.3 security update on RHEL 8","status":"published","published":"2024-09-30T16:26:17Z","modified":"2026-10-13T10:04:13Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:2707","title":"Red Hat Security Advisory: Red Hat Single Sign-On 7.6.3 security update on RHEL 9","status":"published","published":"2024-09-30T16:26:27Z","modified":"2026-10-13T10:04:13Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"ROOT-APP-MAVEN-CVE-2021-0341","title":"CVE-2021-0341 in com.squareup.okhttp3:okhttp - Patched by Root","description":"Root has patched CVE-2021-0341 in the com.squareup.okhttp3:okhttp package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-10-15T08:21:50Z","modified":"2026-10-15T09:15:03.265075985Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:27.066589Z"},{"id":"ASB-A-171980069","description":"In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","status":"published","published":"2021-02-01T00:00:00Z","modified":"2026-11-10T17:02:23.040266809Z","updated_at":"2026-11-09T17:04:22.742827Z"},{"id":"CLSA-2025-1766707708","title":"TuxCare security update for com.squareup.okhttp3:okhttp (1 CVE)","description":"TuxCare rebuilt com.squareup.okhttp3:okhttp to address 1 CVE. Fixed in 3.14.9-tuxcare.1.","status":"published","published":"2026-08-04T14:52:06Z","modified":"2026-11-02T19:45:13.541012299Z","updated_at":"2026-11-02T20:30:40.499236Z"}]}}