GHSA-gxq5-79m2-gvvq
Apache Bookkeeper vulnerable to Improper Certificate Validation
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.apache.bookkeeper:bookkeeper-common | < 4.14.6 | 4.14.6 |
| Maven | org.apache.bookkeeper:bookkeeper-common | >= 4.15.0, < 4.15.1 | 4.15.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
The Apache Bookkeeper Java Client (before 4.14.6 and also 4.15.0) does not close the connection to the bookkeeper server when TLS hostname verification fails. This leaves the bookkeeper client vulnerable to a man in the middle attack. The problem affects BookKeeper client prior to versions 4.14.6 and 4.15.1.
References
External links from the advisory. They lead to third-party sites.