Vulnerability · Published Dec 15, 2022 · Assigned by apache

CVE-2022-32531Apache BookKeeper: Java Client Uses Connection to Host that Failed Hostname Verification

Medium 5.9

In plain English

A medium-severity improper certificate validation in Apache BookKeeper from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)1.1%top 34.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Apache Bookkeeper Java Client (before 4.14.6 and also 4.15.0) does not close the connection to the bookkeeper server when TLS hostname verification fails. This leaves the bookkeeper client vulnerable to a man in the middle attack. The problem affects BookKeeper client prior to versions 4.14.6 and 4.15.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.apache.bookkeeper:bookkeeper-common	4.14.6	GHSA-gxq5-79m2-gvvq
Maven	org.apache.bookkeeper:bookkeeper-common	4.15.1	GHSA-gxq5-79m2-gvvq
PyPI	apache-bookkeeper-client	4.14.6	PYSEC-2022-43060
Ubuntu:22.04:LTS	bookkeeper	no fix listed	UBUNTU-CVE-2022-32531

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache BookKeeper	0 – through 4.14.54.15.0

Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

References

https://lists.apache.org/thread/xyk2lfc7lzof8mksmwyympbqxts1b5s9 vendor-advisory