{"action":"opened","issue":{"url":"https://api.github.com/repos/square/okhttp/issues/4199","repository_url":"https://api.github.com/repos/square/okhttp","labels_url":"https://api.github.com/repos/square/okhttp/issues/4199/labels{/name}","comments_url":"https://api.github.com/repos/square/okhttp/issues/4199/comments","events_url":"https://api.github.com/repos/square/okhttp/issues/4199/events","html_url":"https://github.com/square/okhttp/issues/4199","id":348973596,"node_id":"MDU6SXNzdWUzNDg5NzM1OTY=","number":4199,"title":"[Security] Fragile cipher suites supported, would you like to remove them?","user":{"login":"jackyvictory","id":15244562,"node_id":"MDQ6VXNlcjE1MjQ0NTYy","avatar_url":"https://avatars0.githubusercontent.com/u/15244562?v=4","gravatar_id":"","url":"https://api.github.com/users/jackyvictory","html_url":"https://github.com/jackyvictory","followers_url":"https://api.github.com/users/jackyvictory/followers","following_url":"https://api.github.com/users/jackyvictory/following{/other_user}","gists_url":"https://api.github.com/users/jackyvictory/gists{/gist_id}","starred_url":"https://api.github.com/users/jackyvictory/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jackyvictory/subscriptions","organizations_url":"https://api.github.com/users/jackyvictory/orgs","repos_url":"https://api.github.com/users/jackyvictory/repos","events_url":"https://api.github.com/users/jackyvictory/events{/privacy}","received_events_url":"https://api.github.com/users/jackyvictory/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-08-09T04:28:58Z","updated_at":"2018-08-09T04:28:58Z","closed_at":null,"author_association":"NONE","body":"What kind of issue is this?\r\n\r\n - [ ] Bug report. If you’ve found a bug, spend the time to write a failing test. Bugs with tests\r\n       get fixed. Here’s an example: https://gist.github.com/swankjesse/981fcae102f513eb13ed\r\n\r\nOur apk with OKHttp is under the security inspection of IBM AppScan, and get the issue that `Android: Weak SSL Cipher Suites are Supported`. Here is the details of this issue: \r\n\r\nTitle | Description\r\n-- | --\r\nSeverity | High \r\nStatus | New\r\nClassification | Definitive\r\nLocation | (okhttp3\\internal\\connection\\RealConnection.java:241)\r\nCalling Line | (okhttp3\\internal\\connection\\RealConnection.java:241)\r\nCalling Method | okhttp3.internal.connection.RealConnection.connectTls(int, int, okhttp3.internal.connection.Conn ectionSpecSelector):void\r\nClass | com.xxx.xxx\r\nPackage | com.xxx.xxx\r\nAvailability Impact | Partial\r\nConfidentiality Impact | Partial\r\nIntegrity Impact | Partial\r\nDate Created | Wednesday, July 11, 2018\r\nLast Updated | Wednesday, July 11, 2018\r\nRisk | It is possible to steal or manipulate customer session and cookies, which might be used to impersonate a legitimate user, allowing the hacker to view or alter user records, and to perform  \t\t\t\t\t\t\t\ttransactions as that user.\r\nCauses | The web server or application server are configured insecurely.\r\nPayload |\r\nIntent Package | com.xxx.xxx\r\nIntent Class | com.xxx.xxx\r\nMethod Signature | javax.net.ssl.SSLParameters.setCipherSuites(java.lang.String[]):void\r\nIssue Validation Parameters - Name | ciph￼￼￼￼￼￼￼erSuites\r\nIssue Validation Parameters - Value | TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA25, **_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_**,**_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_**,**_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_**,**_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_**,TLS_RSA_WITH_AES_128_GCM_SHA256,**_TLS_RSA_WITH_AES_128_CBC_SHA_**,**_TLS_RSA_WITH_AES_256_CBC_SHA_**\r\n\r\nThe above with **_bold and italic_** are reported as the cause of this issue.  As far as I'm concerned, it is **_SHA_** that considered fragile by IBM AppScan. In fact it is an outdated algorithm and many security standards such as PCI consider it fragile. \r\n\r\nSo, would you like to upgrade OKHttp, deprecate **_SHA_** to make it complies with these security standards? Or else some apk with high security requirements may face the same problem."}}
{"actor":{"display_login":"jackyvictory"}}