cve-2022-32531
Vulnerability from cvelistv5
Published
2022-12-15 10:17
Modified
2024-08-03 07:46
Severity ?
Summary
The Apache Bookkeeper Java Client (before 4.14.6 and also 4.15.0) does not close the connection to the bookkeeper server when TLS hostname verification fails. This leaves the bookkeeper client vulnerable to a man in the middle attack. The problem affects BookKeeper client prior to versions 4.14.6 and 4.15.1.
References
security@apache.orghttps://lists.apache.org/thread/xyk2lfc7lzof8mksmwyympbqxts1b5s9Mailing List, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread/xyk2lfc7lzof8mksmwyympbqxts1b5s9Mailing List, Vendor Advisory
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T07:46:44.696Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread/xyk2lfc7lzof8mksmwyympbqxts1b5s9"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache BookKeeper",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "4.14.5",
              "status": "affected",
              "version": "0",
              "versionType": "maven"
            },
            {
              "status": "affected",
              "version": "4.15.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThe Apache Bookkeeper Java Client (before 4.14.6 and also 4.15.0) does not close the connection to the\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e bookkeeper server when TLS hostname verification fails. This leaves\u003c/span\u003e\u003cbr\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ethe bookkeeper client vulnerable to a man in the middle attack.\u003cbr\u003e\u003c/span\u003e\u003cbr\u003eThe problem affects BookKeeper client prior to versions 4.14.6 and 4.15.1."
            }
          ],
          "value": "The Apache Bookkeeper Java Client (before 4.14.6 and also 4.15.0) does not close the connection to the bookkeeper server when TLS hostname verification fails. This leaves\nthe bookkeeper client vulnerable to a man in the middle attack.\n\nThe problem affects BookKeeper client prior to versions 4.14.6 and 4.15.1."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "Moderate"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295 Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-15T10:17:19.660Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/xyk2lfc7lzof8mksmwyympbqxts1b5s9"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Upgrade to 4.14.6 or to 4.15.1\u003cbr\u003e"
            }
          ],
          "value": "Upgrade to 4.14.6 or to 4.15.1\n"
        }
      ],
      "source": {
        "advisory": "https://github.com/apache/bookkeeper/pull/3310",
        "discovery": "UNKNOWN"
      },
      "title": "Apache BookKeeper: Java Client Uses Connection to Host that Failed Hostname Verification",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2022-32531",
    "datePublished": "2022-12-15T10:17:19.660Z",
    "dateReserved": "2022-06-07T08:44:04.580Z",
    "dateUpdated": "2024-08-03T07:46:44.696Z",
    "requesterUserId": "01d7ebfd-4418-401d-b8e4-f5ae3da29160",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:bookkeeper:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"4.14.6\", \"matchCriteriaId\": \"165DDEED-2AA8-4C6A-9A17-2F5639812306\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:bookkeeper:4.15.0:-:*:*:*:*:*:*\", \"matchCriteriaId\": \"FEB56DB4-7402-4BE9-B580-6AD8E18BD6D5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:bookkeeper:4.15.0:rc0:*:*:*:*:*:*\", \"matchCriteriaId\": \"25931EF6-B967-4782-86EE-65764DD46FE1\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"The Apache Bookkeeper Java Client (before 4.14.6 and also 4.15.0) does not close the connection to the bookkeeper server when TLS hostname verification fails. This leaves\\nthe bookkeeper client vulnerable to a man in the middle attack.\\n\\nThe problem affects BookKeeper client prior to versions 4.14.6 and 4.15.1.\"}, {\"lang\": \"es\", \"value\": \"El cliente Java Apache Bookkeeper (anteriores a 4.14.6 y tambi\\u00e9n a 4.15.0) no cierra la conexi\\u00f3n con el servidor de contabilidad cuando falla la verificaci\\u00f3n del nombre de host TLS. Esto deja al cliente bookkeeper vulnerable al ataque de man in the middle. El problema afecta al cliente BookKeeper anterior a las versiones 4.14.6 y 4.15.1.\"}]",
      "id": "CVE-2022-32531",
      "lastModified": "2024-11-21T07:06:34.430",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N\", \"baseScore\": 5.9, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.2, \"impactScore\": 3.6}]}",
      "published": "2022-12-15T19:15:17.673",
      "references": "[{\"url\": \"https://lists.apache.org/thread/xyk2lfc7lzof8mksmwyympbqxts1b5s9\", \"source\": \"security@apache.org\", \"tags\": [\"Mailing List\", \"Vendor Advisory\"]}, {\"url\": \"https://lists.apache.org/thread/xyk2lfc7lzof8mksmwyympbqxts1b5s9\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Vendor Advisory\"]}]",
      "sourceIdentifier": "security@apache.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"security@apache.org\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-295\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-32531\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2022-12-15T19:15:17.673\",\"lastModified\":\"2024-11-21T07:06:34.430\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The Apache Bookkeeper Java Client (before 4.14.6 and also 4.15.0) does not close the connection to the bookkeeper server when TLS hostname verification fails. This leaves\\nthe bookkeeper client vulnerable to a man in the middle attack.\\n\\nThe problem affects BookKeeper client prior to versions 4.14.6 and 4.15.1.\"},{\"lang\":\"es\",\"value\":\"El cliente Java Apache Bookkeeper (anteriores a 4.14.6 y tambi\u00e9n a 4.15.0) no cierra la conexi\u00f3n con el servidor de contabilidad cuando falla la verificaci\u00f3n del nombre de host TLS. Esto deja al cliente bookkeeper vulnerable al ataque de man in the middle. El problema afecta al cliente BookKeeper anterior a las versiones 4.14.6 y 4.15.1.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":5.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.2,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security@apache.org\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-295\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:bookkeeper:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.14.6\",\"matchCriteriaId\":\"165DDEED-2AA8-4C6A-9A17-2F5639812306\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:bookkeeper:4.15.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"FEB56DB4-7402-4BE9-B580-6AD8E18BD6D5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:bookkeeper:4.15.0:rc0:*:*:*:*:*:*\",\"matchCriteriaId\":\"25931EF6-B967-4782-86EE-65764DD46FE1\"}]}]}],\"references\":[{\"url\":\"https://lists.apache.org/thread/xyk2lfc7lzof8mksmwyympbqxts1b5s9\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\",\"Vendor Advisory\"]},{\"url\":\"https://lists.apache.org/thread/xyk2lfc7lzof8mksmwyympbqxts1b5s9\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.