GitHub Advisoryadvisory · Maven

GHSA-37gx-jqx9-fwmg Improper Certificate Validation in Apache DolphinScheduler

HIGH Published 2024-02-20 Modified 2025-02-13 Official page ↗
Aliases
CVE-2023-49250
Ecosystem
Maven
Packages
org.apache.dolphinscheduler:dolphinscheduler
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-295
Reviewed
2024-02-21

Affected packages

• Maven org.apache.dolphinscheduler:dolphinscheduler: < 3.2.1 → fixed in 3.2.1

Description

Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle (MITM) attack on outgoing https connections could impersonate the server. This issue affects Apache DolphinScheduler: before 3.2.1. Users are recommended to upgrade to version 3.2.1, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2023-49250 Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle (MITM) attack on outgoing https… vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References