GHSA-gxq5-79m2-gvvq

ghsaUSosv

Apache Bookkeeper vulnerable to Improper Certificate Validation

view advisory published 2022-12-15Licence: CC-BY-4.0

The Apache Bookkeeper Java Client (before 4.14.6 and also 4.15.0) does not close the connection to the bookkeeper server when TLS hostname verification fails. This leaves the bookkeeper client vulnerable to a man in the middle attack. The problem affects BookKeeper client prior to versions 4.14.6 and 4.15.1.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-32531US	medium5.9	1.09% (65th)	—	2022-12-15
The Apache Bookkeeper Java Client (before 4.14.6 and also 4.15.0) does not close the connection to the bookkeeper server when TLS hostname verification fails. This leaves the bookk…

references

External citations — patches, advisories, analysis.

https://github.com/apache/bookkeeperPACKAGE
https://github.com/pypa/advisory-database/tree/main/vulns/apache-bookkeeper-client/PYSEC-2022-43060.yamlWEB
https://lists.apache.org/thread/xyk2lfc7lzof8mksmwyympbqxts1b5s9WEB
https://nvd.nist.gov/vuln/detail/CVE-2022-32531ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan