CVE-2017-7192

High

Published: 06/04/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

WebSocket.swift in Starscream before version 2.0.4 allows an SSL Pinning bypass due to incorrect management of the certValidated variable, which can be set to true but cannot be set to false.

Risk Assessment

Organizations may be exposed to man-in-the-middle attacks, potentially leading to interception of data transmitted over unsecured connections.

Recommendation

It is recommended to update Starscream to version 2.0.4 or later to mitigate this vulnerability.

Other vulnerabilities in Starscream

CVE-2017-5887High
WebSocket.swift in Starscream before version 2.0.4 allows an SSL Pinning bypass because pinning occurs in the stream function, which is too late; pinning should occur in the initStreamsWithData function.

Original NVD description (English source)

WebSocket.swift in Starscream before 2.0.4 allows an SSL Pinning bypass because of incorrect management of the certValidated variable (it can be set to true but cannot be set to false).