CVE Catalog
CVE-2017-5887
HighSummary
WebSocket.swift in Starscream before version 2.0.4 allows an SSL Pinning bypass because pinning occurs in the stream function, which is too late; pinning should occur in the initStreamsWithData function.
Risk Assessment
The SSL Pinning bypass may lead to interception of data transmitted over WebSocket, posing a serious threat to communication security.
Recommendation
Update Starscream to version 2.0.4 or later to fix the security vulnerability related to SSL Pinning.
Other vulnerabilities in Starscream
Original NVD description (English source)
WebSocket.swift in Starscream before 2.0.4 allows an SSL Pinning bypass because pinning occurs in the stream function (this is too late; pinning should occur in the initStreamsWithData function).