The vulnerability of the `HttpUtils#getURLConnection` method in the Apache Calcite dynamic data management framework allows a attacker to execute a “man-in-the-middle” attack or gain unauthorized access to protected information.

The vulnerability of the HttpUtilsgetURLConnection method in the Apache Calcite dynamic data management framework is related to the absence of authentication procedures. Exploiting this vulnerability could allow an attacker to execute a “man-in-the-middle” attack or gain unauthorized access to...

CVE-2020-13955

HttpUtilsgetURLConnection method disables explicitly hostname verification for HTTPS connections making clients vulnerable to man-in-the-middle attacks. Calcite uses internally this method to connect with Druid and Splunk so information leakage may happen when using the respective Calcite adapter...

CVE-2020-13955

HttpUtilsgetURLConnection method disables explicitly hostname verification for HTTPS connections making clients vulnerable to man-in-the-middle attacks. Calcite uses internally this method to connect with Druid and Splunk so information leakage may happen when using the respective Calcite adapter...

CVE-2020-13955: Improper Certificate Validation

HttpUtilsgetURLConnection method disables explicitly hostname verification for HTTPS connections making clients vulnerable to man-in-the-middle attacks. Calcite uses internally this method to connect with Druid and Splunk so information leakage may happen when using the respective Calcite adapter...

PT-2020-5838

Name of the Vulnerable Software and Affected Versions: Apache Calcite versions prior to 1.26 Description: The issue is related to the HttpUtilsgetURLConnection method, which disables hostname verification for HTTPS connections, making clients vulnerable to man-in-the-middle attacks. This method i...