CVE-2022-32531CWE-295

Apache BookKeeper: Java Client Uses Connection to Host that Failed Hostname Verification

Medium · published December 15, 2022

CVSS v3.1
5.9
EPSS
1%
Percentile
65.0
In the wild
Unconfirmed
What it is

The Apache Bookkeeper Java Client (before 4.14.6 and also 4.15.0) does not close the connection to the bookkeeper server when TLS hostname verification fails. This leaves

the bookkeeper client vulnerable to a man in the middle attack.

The problem affects BookKeeper client prior to versions 4.14.6 and 4.15.1.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01088 · 65.0th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2022-12-15T10:17Z
EPSS history
Timeline
  • 15 DEC 10:17Z
    Apache BookKeeper: Java Client Uses Connection to Host that Failed Hostname Verification
    cvelistv5