GitHub Advisoryadvisory · Maven

GHSA-gxq5-79m2-gvvq Apache Bookkeeper vulnerable to Improper Certificate Validation

MEDIUM Published 2022-12-15 Modified 2022-12-20 Official page ↗
Aliases
CVE-2022-32531
Ecosystem
Maven
Packages
org.apache.bookkeeper:bookkeeper-common
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-295
Reviewed
2022-12-15

Affected packages

• Maven org.apache.bookkeeper:bookkeeper-common: < 4.14.6 → fixed in 4.14.6 • Maven org.apache.bookkeeper:bookkeeper-common: >= 4.15.0, < 4.15.1 → fixed in 4.15.1

Description

The Apache Bookkeeper Java Client (before 4.14.6 and also 4.15.0) does not close the connection to the bookkeeper server when TLS hostname verification fails. This leaves the bookkeeper client vulnerable to a man in the middle attack. The problem affects BookKeeper client prior to versions 4.14.6 and 4.15.1.

Related

Alias · CVE (1)

  • CVE-2022-32531 The Apache Bookkeeper Java Client (before 4.14.6 and also 4.15.0) does not close the connection to the bookkeeper server when TLS hostname… vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References