Firebase-android-sdk: firebase-functions uses okhttp:2.7.2 which has a MITM vulnerability: CVE-2016-2402

[miraculix-druids]

firebase-functions uses okhttp:2.7.2 which has a MITM vulnerability: CVE-2016-2402

https://github.com/firebase/firebase-android-sdk/blob/master/firebase-functions/firebase-functions.gradle contains:
implementation 'com.squareup.okhttp:okhttp:2.7.2'

https://nvd.nist.gov/vuln/detail/CVE-2016-2402:

OkHttp before 2.7.4 and 3.x before 3.1.2 allows man-in-the-middle attackers to bypass certificate pinning by sending a certificate chain with a certificate from a non-pinned trusted CA and the pinned certificate.

Advise: Update okhttp dependency to 2.7.4 or 2.7.5

[vladaman]

Please consider to switch to com.squareup.okhttp3:okhttp:3.10 or newer.

[ashwinraghav]

Thanks for notifying. Our upcoming release lifts the version of okhttp to 2.7.5.
At this point we are unable to upgrade to 3.x since a downstream dependency transitively depends on 2.X and this would be a breaking change.

FYI: I have a #100 that might help remove this dep all together.

[khansahib142]

implementation 'com.google.firebase:firebase-auth:16.0.1:15.0.0'
facing to implement