CVE-2022-32531 Apache BookKeeper: Java Client Uses Connection to Host that Failed Hostname Verification

2022-12-1510:17:19

CWE-295

apache

www.cve.org

apache bookkeeper

java client

tls hostname verification

5.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

33.1%

JSON

The Apache Bookkeeper Java Client (before 4.14.6 and also 4.15.0) does not close the connection to the bookkeeper server when TLS hostname verification fails. This leaves
the bookkeeper client vulnerable to a man in the middle attack.

The problem affects BookKeeper client prior to versions 4.14.6 and 4.15.1.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache BookKeeper",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "4.14.5",
        "status": "affected",
        "version": "0",
        "versionType": "maven"
      },
      {
        "status": "affected",
        "version": "4.15.0"
      }
    ]
  }
]