CVE-2021-0341

[bestbeforetoday]

See square/okhttp#6724.

com.ibm.cloud:cloudant:0.1.3 has a transient dependency on okhttp 4.9.1 via com.ibm.cloud:sdk-core:9.17.1:

[INFO] com.ibm.cloud:cloudant:jar:0.1.3
[INFO] +- com.ibm.cloud:cloudant-common:jar:0.1.3:compile
[INFO] +- com.google.code.gson:gson:jar:2.9.0:compile
[INFO] \- com.ibm.cloud:sdk-core:jar:9.17.1:compile
[INFO]    +- com.squareup.okhttp3:logging-interceptor:jar:4.9.1:compile
[INFO]    +- com.squareup.okhttp3:okhttp-urlconnection:jar:4.9.1:compile
[INFO]    +- commons-codec:commons-codec:jar:1.15:compile
[INFO]    +- commons-io:commons-io:jar:2.7:compile
[INFO]    +- org.apache.commons:commons-lang3:jar:3.8.1:compile
[INFO]    +- com.google.guava:guava:jar:30.1.1-jre:compile
[INFO]    |  +- com.google.guava:failureaccess:jar:1.0.1:compile
[INFO]    |  +- com.google.guava:listenablefuture:jar:9999.0-empty-to-avoid-conflict-with-guava:compile
[INFO]    |  +- com.google.code.findbugs:jsr305:jar:3.0.2:compile
[INFO]    |  +- org.checkerframework:checker-qual:jar:3.8.0:compile
[INFO]    |  +- com.google.errorprone:error_prone_annotations:jar:2.5.1:compile
[INFO]    |  \- com.google.j2objc:j2objc-annotations:jar:1.3:compile
[INFO]    +- io.reactivex.rxjava2:rxjava:jar:2.2.7:compile
[INFO]    |  \- org.reactivestreams:reactive-streams:jar:1.0.2:compile
[INFO]    \- org.jetbrains.kotlin:kotlin-stdlib:jar:1.6.21:compile
[INFO]       +- org.jetbrains.kotlin:kotlin-stdlib-common:jar:1.6.21:compile
[INFO]       \- org.jetbrains:annotations:jar:13.0:compile

Updating to com.ibm.cloud:sdk-core:9.17.2 resolves this:

[INFO] com.ibm.cloud:cloudant:jar:0.1.3
[INFO] +- com.ibm.cloud:cloudant-common:jar:0.1.3:compile
[INFO] +- com.google.code.gson:gson:jar:2.9.0:compile
[INFO] \- com.ibm.cloud:sdk-core:jar:9.17.2:compile
[INFO]    +- com.squareup.okhttp3:logging-interceptor:jar:4.9.3:compile
[INFO]    +- com.squareup.okhttp3:okhttp-urlconnection:jar:4.9.3:compile
[INFO]    +- commons-codec:commons-codec:jar:1.15:compile
[INFO]    +- commons-io:commons-io:jar:2.7:compile
[INFO]    +- org.apache.commons:commons-lang3:jar:3.8.1:compile
[INFO]    +- com.google.guava:guava:jar:30.1.1-jre:compile
[INFO]    |  +- com.google.guava:failureaccess:jar:1.0.1:compile
[INFO]    |  +- com.google.guava:listenablefuture:jar:9999.0-empty-to-avoid-conflict-with-guava:compile
[INFO]    |  +- com.google.code.findbugs:jsr305:jar:3.0.2:compile
[INFO]    |  +- org.checkerframework:checker-qual:jar:3.8.0:compile
[INFO]    |  +- com.google.errorprone:error_prone_annotations:jar:2.5.1:compile
[INFO]    |  \- com.google.j2objc:j2objc-annotations:jar:1.3:compile
[INFO]    +- io.reactivex.rxjava2:rxjava:jar:2.2.7:compile
[INFO]    |  \- org.reactivestreams:reactive-streams:jar:1.0.2:compile
[INFO]    \- org.jetbrains.kotlin:kotlin-stdlib:jar:1.6.21:compile
[INFO]       +- org.jetbrains.kotlin:kotlin-stdlib-common:jar:1.6.21:compile
[INFO]       \- org.jetbrains:annotations:jar:13.0:compile

[ricellis]

I don't think this is actually exploitable in java-sdk-core or cloudant-java-sdk because we don't interact directly with the OkHostNameVerifier, but nonetheless it will be resolved by #298 and followed shortly be a new release.

[eiri]

Addressed in https://github.com/IBM/cloudant-java-sdk/releases/tag/v0.1.4