Commit f0bc432
Fix okhttp vulnerability CVE-2021-0341
Summary:
GitHub detected a critical security vulnerability (CVE-2021-0341) in the
com.squareup.okhttp3:okhttp dependency used in Java SDK examples.
What broke:
OkHttp versions < 4.9.2 are vulnerable to CVE-2021-0341, where the library
fails to properly verify hostnames during TLS certificate validation. This
could allow man-in-the-middle attacks against HTTPS connections made by the
Java Business SDK examples.
How we're fixing it:
Bumped okhttp from 3.9.1 to 4.12.0 in both pom.xml files:
- codegen/templates/java/examples/pom.xml (facebook-business-sdk-codegen)
- sdk/servers/java/release/examples/pom.xml (facebook-java-business-sdk)
Version 4.12.0 is the latest stable 4.x release, well above the minimum
fix version of 4.9.2.
Differential Revision: D99888404
fbshipit-source-id: 64e8359f7b9afdf66b22f2b6c6f903b20cf20aaa1 parent 4016fe2 commit f0bc432
1 file changed
Lines changed: 1 addition & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
257 | 257 | | |
258 | 258 | | |
259 | 259 | | |
260 | | - | |
| 260 | + | |
261 | 261 | | |
262 | 262 | | |
263 | 263 | | |
| |||
0 commit comments