René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[Java]: CVE-2020-26234 - Insecure TrustManager - MiTM ","articleBody":"## CVE ID(s)\r\n\r\n*List the CVE ID(s) associated with this vulnerability. GitHub will automatically link CVE IDs to the [GitHub Advisory Database](https://github.com/advisories).*\r\n\r\n[CVE-2020-26234](https://github.com/advisories/GHSA-44cw-p2hm-gpf6)\r\n\r\n## Report\r\n*Describe the vulnerability. Provide any information you think will help GitHub assess the impact your query has on the open source community.*\r\n\r\nA insecure ``TrustManager`` is an implementation of the ``TrustManager`` interface, where the checkServerTrusted method trusts any certificate because it never throws a CertificateException.\r\nAs the ``TrustManager`` trusts any certificate, an attacker can create a self-signed certificate that will be accepted as any certificate is trusted. This leads to a MiTM attack against the connection thereby stealing sensitive secrets such as login data or other tokens is possible.\r\n\r\n\r\n\r\n- [ ] Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc). *We would love to have you spread the word about the good work you are doing*\r\n\r\n##Query:\r\n\r\ngithub/codeql#4879\r\n\r\n## Result(s)\r\n\r\n[CVE-2020-26234](https://github.com/advisories/GHSA-44cw-p2hm-gpf6)\r\n","author":{"url":"https://github.com/andripwn","@type":"Person","name":"andripwn"},"datePublished":"2021-01-03T22:01:26.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":2},"url":"https://github.com/224/securitylab/issues/224"}