CVE-2017-7192

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2017-7192

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-7192.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2017-7192

Published

2017-04-06T14:59:00.363Z

Modified

2026-07-08T16:53:25.146720Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

[none]

Details

WebSocket.swift in Starscream before 2.0.4 allows an SSL Pinning bypass because of incorrect management of the certValidated variable (it can be set to true but cannot be set to false).

References

Affected packages

Git / github.com/daltoniam/starscream

Affected ranges

Type

GIT

Repo

https://github.com/daltoniam/starscream

Events

Introduced

Last affected

13859364e33368687a5ee0c9cc0d5782e4212b66

Fixed

dbeb1190b8dcbff4f0b797f9e9d9b9b864d1f0d6

Fixed

85070aab91d3f8495d8bd378e81dcc00b368898c

Database specific

{
    "cpe": "cpe:2.3:a:starscream_project:starscream:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.0.3"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

0.*

0.9.1

0.9.2

0.9.3

0.9.4

0.9.5

0.9.6

0.9.7

1.*

1.0.0

1.0.1

1.0.2

1.1.0

1.1.1

1.1.2

1.1.3

1.1.4

2.*

2.0.0

2.0.1

2.0.2

2.0.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-7192.json"