CVE-2021-0341

一、漏洞信息
 漏洞编号：[CVE-2021-0341](https://nvd.nist.gov/vuln/detail/CVE-2021-0341)
 漏洞归属组件：[log4j](https://gitee.com/src-openeuler/log4j)
 漏洞归属的版本：2.13.2,2.17.0,2.17.2
 CVSS V3.0分值：
  BaseScore：7.5 High
  Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
 漏洞简述：
  In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-171980069
 漏洞公开时间：2021-02-11 01:15:22
 漏洞创建时间：2025-11-21 13:12:26
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2021-0341
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
|  | https://android.googlesource.com/platform/external/okhttp/+/ddc934efe3ed06ce34f3724d41cfbdcd7e7358fc |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2021-0341 |  |
|  | https://access.redhat.com/security/cve/CVE-2021-0341 |  |
|  | https://www.oracle.com/security-alerts/cpujan2024.html |  |
|  | https://source.android.com/security/bulletin/2021-02-01 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=2154086 |  |
|  | https://www.cve.org/CVERecord?id=CVE-2021-0341 |  |
|  | https://android.googlesource.com/platform/libcore/+/4076be9a99bad5ff7651540df976c57462c3b8ce |  |
|  | https://github.com/square/okhttp/commit/f574ea2f5259d9040f264ddeb582fb1ce563f10c |  |
|  | https://github.com/advisories/GHSA-3cqm-mf7h-prrj |  |
|  | https://source.android.com/security/bulletin/2021-02-01#2021-02-01-security-patch-level-vulnerability-details |  |
|  | https://github.com/square/okhttp/issues/6724 |  |
|  | https://github.com/square/okhttp/pull/6741 |  |
|  | https://vigilance.fr/vulnerability/Google-Android-Pixel-multiple-vulnerabilities-of-February-2021-34454 |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  七彩瞬析开源风险感知平台
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://android.googlesource.com/platform/external/okhttp/+/ddc934efe3ed06ce34f3724d41cfbdcd7e7358fc.patch |  | ljqc |
|  |  | https://github.com/square/okhttp/commit/f574ea2f5259d9040f264ddeb582fb1ce563f10c |  | github_advisory |
|  |  | https://github.com/square/okhttp/pull/6741 |  | github_advisory |

</details>
 
二、漏洞分析结构反馈
 影响性分析说明：
  
 openEuler评分：
   
 受影响版本排查(受影响/不受影响)：
  1.master(2.17.2):
2.openEuler-20.03-LTS-SP4(2.17.0):
3.openEuler-22.03-LTS-SP3(2.17.2):
4.openEuler-22.03-LTS-SP4(2.17.2):
5.openEuler-24.03-LTS(2.17.2):
6.openEuler-24.03-LTS-Next(2.17.2):
7.openEuler-24.03-LTS-SP1(2.17.2):
8.openEuler-24.03-LTS-SP2(2.17.2):
9.openEuler-24.03-LTS-SP3(2.17.2):

修复是否涉及abi变化(是/否)：
  1.master(2.17.2):
2.openEuler-20.03-LTS-SP4(2.17.0):
3.openEuler-22.03-LTS-SP3(2.17.2):
4.openEuler-22.03-LTS-SP4(2.17.2):
5.openEuler-24.03-LTS(2.17.2):
6.openEuler-24.03-LTS-Next(2.17.2):
7.openEuler-24.03-LTS-SP1(2.17.2):
8.openEuler-24.03-LTS-SP2(2.17.2):
9.openEuler-24.03-LTS-SP3(2.17.2):

原因说明：
  1.master(2.17.2):
2.openEuler-20.03-LTS-SP4(2.17.0):
3.openEuler-22.03-LTS-SP3(2.17.2):
4.openEuler-22.03-LTS-SP4(2.17.2):
5.openEuler-24.03-LTS(2.17.2):
6.openEuler-24.03-LTS-Next(2.17.2):
7.openEuler-24.03-LTS-SP1(2.17.2):
8.openEuler-24.03-LTS-SP2(2.17.2):
9.openEuler-24.03-LTS-SP3(2.17.2):

src-openEuler/log4j
Closed

Content Risk Flag

Comments (4)

src-openEuler/log4jClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2021-0341

Comments (4)

Search

src-openEuler/log4j
Closed