GHSA-h6x7-r5rg-x5fw
Serverpod client accepts any certificate
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Pub | serverpod_client | < 1.2.6 | 1.2.6 |
Details
As written in the advisory (Markdown source, shown as plain text).
This bug bypassed the validation of TSL certificates on all none web HTTP clients in the `serverpod_client` package. Making them susceptible to a man in the middle attack against encrypted traffic between the client device and the server.
An attacker would need to be able to intercept the traffic and highjack the connection to the server for this vulnerability to be used.
### Impact
All versions of `serverpod_client` pre `1.2.6`
### Patches
Upgrading to version `1.2.6` resolves this issue.
References
External links from the advisory. They lead to third-party sites.