High/Critical Security threat in JavaWebSocket dependency used by pusher

[HylkeB]

What is the issue?

This pusher library uses a version of the JavaWebSocket dependency that has a high / critical security bug:

In Java-WebSocket less than or equal to 1.4.1, there is an Improper Validation of Certificate with Host Mismatch where WebSocketClient does not perform SSL hostname validation. This has been patched in 1.5.0
https://nvd.nist.gov/vuln/detail/CVE-2020-11050

Any improvements you suggest

Update the JavaWebSocket dependency to version 1.5.0 or higher

---

CC @pusher/mobile

[daniellevass]

Hey,

Thanks for reaching out to report!

I'll look to get that fix rolled out asap and will keep this issue updated with that progress.

Danielle.