CVE-2021-0341
About
In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-171980069
Rainforest analyst review
The bug is in Android's OkHostnameVerifier: flawed hostname verification can accept a certificate issued for the wrong domain, which quietly breaks the guarantee TLS is supposed to provide. It's remote and needs no user interaction, and the consequence is that an attacker positioned in the network path can impersonate servers and intercept supposedly-protected traffic.
A hostname-verification failure undermines transport trust broadly, and it spans a wide range of Android versions, so the exposure isn't limited to one release. An attacker who can get into the traffic path, on hostile Wi-Fi, for instance, can present a mismatched certificate and have it accepted, turning encrypted sessions into readable ones.
Our angle is twofold: patch the OS across the affected fleet, and remember that the vulnerable verifier is OkHttp code that apps also bundle independently. So beyond the platform update, we look for applications shipping an affected OkHttp, since a patched OS doesn't fix a copy compiled into an app.
References
Related CVEs
No related CVEs.
Frequently asked questions
What is CVE-2021-0341?
In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-171980069
How severe is CVE-2021-0341?
CVE-2021-0341 carries a CVSS 3.1 base score of 7.5, rated high. On the Rainforest Risk Index — which weighs the severity alongside how easy the flaw is to reach and how broad its impact is — it scores 75 out of 100, in the high band.
How is CVE-2021-0341 exploited?
According to the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N): attack vector Network, attack complexity Low, privileges required None, user interaction None. Impact on confidentiality High, integrity None and availability None.
Which products are affected by CVE-2021-0341?
Public advisories list the following as affected: android. Check the references on this page for the exact versions each vendor confirms.
How do I fix CVE-2021-0341?
Apply the fix the vendor published — the references on this page link to the primary advisories and patches. When patching can't happen right away, reduce the exposure of the affected component and watch it for exploitation attempts. Rainforest customers see this vulnerability correlated to their own assets and prioritized by real exposure, not by score alone.
Empower Your Security Strategy with Rainforest
Discover vulnerabilities early, prioritize critical threats, and protect what truly matters. Rainforest streamlines your security operations, saving you time and reducing costs, so you can focus on what drives your business forward.