Hsnmohd opened a new pull request, #933: URL: https://github.com/apache/httpcomponents-client/pull/933
`chainSpkiSha256` hashed every certificate in `SSLSession.getPeerCertificates()`, the chain as sent rather than the path the trust manager validated, so a server holding any CA-trusted certificate for a pinned host could append the real pinned certificate (public, and ignored by JSSE path building) and pass `enforcePins` (same bypass as OkHttp CVE-2016-2402, reproduced with real handshakes on the classic and async clients); pins now only match the leaf and the presented certificates that verifiably sign it. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
