CVE-2012-5813: The Android_Pusher library for Android does not verify that the server hostname matches a domain name in th...

Security readout for executives and security teams

Android_Pusher could accept a valid TLS certificate even when it was issued for a different website. A person controlling network traffic could impersonate the intended server and intercept or alter app communications. The public record does not provide CVSS, affected versions, or a named patch. Exposure is most likely in legacy Android applications that embedded Android_Pusher. The source bundle lists affected vendor, product, and versions as n/a, so exposure must be determined by software inventory and dependency review. Treat this as an exposure discovery item for legacy Android estates. Escalate if Android_Pusher appears in apps handling authentication, payment, regulated, or customer data. No active exploitation is evidenced in the provided sources. Mitigation focus: Inventory Android apps and dependencies for Android_Pusher usage.; Check project history and vendor guidance for a patched or replacement library.; Replace or update code to use proper platform TLS hostname verification..

Prepared

Jun 24, 2026, 12:04 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.