Skip to content

Commit f0bc432

Browse files
satwikareddy3meta-codesync[bot]
authored andcommitted
Fix okhttp vulnerability CVE-2021-0341
Summary: GitHub detected a critical security vulnerability (CVE-2021-0341) in the com.squareup.okhttp3:okhttp dependency used in Java SDK examples. What broke: OkHttp versions < 4.9.2 are vulnerable to CVE-2021-0341, where the library fails to properly verify hostnames during TLS certificate validation. This could allow man-in-the-middle attacks against HTTPS connections made by the Java Business SDK examples. How we're fixing it: Bumped okhttp from 3.9.1 to 4.12.0 in both pom.xml files: - codegen/templates/java/examples/pom.xml (facebook-business-sdk-codegen) - sdk/servers/java/release/examples/pom.xml (facebook-java-business-sdk) Version 4.12.0 is the latest stable 4.x release, well above the minimum fix version of 4.9.2. Differential Revision: D99888404 fbshipit-source-id: 64e8359f7b9afdf66b22f2b6c6f903b20cf20aaa
1 parent 4016fe2 commit f0bc432

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

examples/pom.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -257,7 +257,7 @@
257257
<dependency>
258258
<groupId>com.squareup.okhttp3</groupId>
259259
<artifactId>okhttp</artifactId>
260-
<version>3.9.1</version>
260+
<version>4.12.0</version>
261261
</dependency>
262262
<dependency>
263263
<groupId>com.google.guava</groupId>

0 commit comments

Comments
 (0)