CertificatePinner.java in OkHttp 3.x through 3.12.0 allows man-in-the-middle attackers to…
Priority LOW 31CWE-295Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-295.
Summary
CertificatePinner.java in OkHttp 3.x through 3.12.0 allows man-in-the-middle attackers to bypass certificate pinning by changing SSLContext and the boolean values while hooking the application. NOTE: This id is disputed because some parties don't consider this is a vulnerability. Their rationale can be found in https://github.com/square/okhttp/issues/4967
Why it matters now
EPSS 0.02477 84th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 9 products
- Red Hat Decision Manager 7
- Red Hat Fuse 7
- Red Hat OpenShift Application Runtimes
- Red Hat OpenShift Container Platform 3.10
- Red Hat OpenShift Container Platform 3.11
- Red Hat OpenShift Container Platform 3.9
- Red Hat OpenShift Container Platform 4
- Red Hat Process Automation 7
- Red Hat Single Sign-On 7
Timeline
- 2026-10-02 Threatist record created from CVE-2018-20200
- 2026-10-03 Alias added: GHSA-qvh7-2qrg-6v75
References
Other 12
- https://github.com/square/okhttp/releases
- https://github.com/square/okhttp/issues/4967
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities
- [flink-user] 20201022 Dependency vulnerabilities with flink 1.11.1 version
- [flink-issues] 20201023 [jira] [Assigned] (FLINK-19784) Upgrade okhttp to 3.13.0 or newer due to CVE-2018-20200
- [flink-issues] 20201023 [jira] [Commented] (FLINK-19784) Upgrade okhttp to 3.13.0 or newer due to CVE-2018-20200
- [flink-issues] 20201023 [jira] [Updated] (FLINK-19784) Upgrade okhttp to 3.13.0 or newer due to CVE-2018-20200
- [flink-issues] 20201026 [jira] [Closed] (FLINK-19784) Upgrade okhttp to 3.13.0 or newer due to CVE-2018-20200
- [flink-issues] 20201026 [jira] [Commented] (FLINK-19784) Upgrade okhttp to 3.13.0 or newer due to CVE-2018-20200
- [pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list
More Squareup Okhttp vulnerabilities
- TI-2016-02158 OkHttp before 2.7.4 and 3.x before 3.1.2 allows man-in-the-middle attackers to bypass… CVSS 3.1MEDIUM 5.9
- TI-2023-00789 Red hat a-mq streams: component version with information disclosure flaw CVSS 3.1MEDIUM 5.5
Sources
- CVE-2018-20200 · CVE Program
- CVE-2018-20200 · NVD
- FIRST EPSS
- GHSA-qvh7-2qrg-6v75 · GitHub Advisory Database · CC BY 4.0
- CVE-2018-20200 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences