{"action":"created","issue":{"url":"https://api.github.com/repos/RestKit/RestKit/issues/2209","labels_url":"https://api.github.com/repos/RestKit/RestKit/issues/2209/labels{/name}","comments_url":"https://api.github.com/repos/RestKit/RestKit/issues/2209/comments","events_url":"https://api.github.com/repos/RestKit/RestKit/issues/2209/events","html_url":"https://github.com/RestKit/RestKit/issues/2209","id":71626295,"number":2209,"title":"SSL validation flaw in AFNetworking 1.3.x in RestKit","user":{"login":"natecode","id":1581257,"avatar_url":"https://avatars.githubusercontent.com/u/1581257?v=3","gravatar_id":"","url":"https://api.github.com/users/natecode","html_url":"https://github.com/natecode","followers_url":"https://api.github.com/users/natecode/followers","following_url":"https://api.github.com/users/natecode/following{/other_user}","gists_url":"https://api.github.com/users/natecode/gists{/gist_id}","starred_url":"https://api.github.com/users/natecode/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/natecode/subscriptions","organizations_url":"https://api.github.com/users/natecode/orgs","repos_url":"https://api.github.com/users/natecode/repos","events_url":"https://api.github.com/users/natecode/events{/privacy}","received_events_url":"https://api.github.com/users/natecode/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-04-28T15:45:50Z","updated_at":"2015-04-29T00:53:48Z","closed_at":"2015-04-28T15:49:30Z","body":"The embedded AFNetworking library in RestKit does not validate cert domain names, and is thus vulnerable to MITM attacks. This issue is mitigated if the caller has enabled cert or public key pinning, but I am not sure if RestKit does this as we haven't fully reviewed and tested it yet.\r\n\r\nIssue: https://github.com/AFNetworking/AFNetworking/issues/2690"},"comment":{"url":"https://api.github.com/repos/RestKit/RestKit/issues/comments/97274737","html_url":"https://github.com/RestKit/RestKit/issues/2209#issuecomment-97274737","issue_url":"https://api.github.com/repos/RestKit/RestKit/issues/2209","id":97274737,"user":{"login":"cossorn","id":1066680,"avatar_url":"https://avatars.githubusercontent.com/u/1066680?v=3","gravatar_id":"","url":"https://api.github.com/users/cossorn","html_url":"https://github.com/cossorn","followers_url":"https://api.github.com/users/cossorn/followers","following_url":"https://api.github.com/users/cossorn/following{/other_user}","gists_url":"https://api.github.com/users/cossorn/gists{/gist_id}","starred_url":"https://api.github.com/users/cossorn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cossorn/subscriptions","organizations_url":"https://api.github.com/users/cossorn/orgs","repos_url":"https://api.github.com/users/cossorn/repos","events_url":"https://api.github.com/users/cossorn/events{/privacy}","received_events_url":"https://api.github.com/users/cossorn/received_events","type":"User","site_admin":false},"created_at":"2015-04-29T00:53:48Z","updated_at":"2015-04-29T00:53:48Z","body":"Please refer to my latest comment in issue 2208. The issue of checking the domain of the URL request vs the domain that is in the certificate exists in AFNetworking 1.3.4, which is resolved in AFNetworking 2.5.3. The issue remains that current RestKit has a dependency, which can be fixed in RestKit."}}