VulnerabilityModified
CVE-2022-32531
This leaves the bookkeeper client vulnerable to a man in the middle attack.
MEDIUM 5.9EPSS 1.02%
Does this matter?
Lower severity and a low EPSS score (1.02%). Track it; it rarely justifies an emergency change on its own.
Description
The Apache Bookkeeper Java Client (before 4.14.6 and also 4.15.0) does not close the connection to the bookkeeper server when TLS hostname verification fails. This leaves the bookkeeper client vulnerable to a man in the middle attack. The problem affects BookKeeper client prior to versions 4.14.6 and 4.15.1.
- CVSS 3.1
- 5.9 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 1.02% probability · 61th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-295
- Affected
- apache/bookkeeper
- Source
- security@apache.org
References
- https://lists.apache.org/thread/xyk2lfc7lzof8mksmwyympbqxts1b5s9Mailing List, Vendor Advisory
- https://lists.apache.org/thread/xyk2lfc7lzof8mksmwyympbqxts1b5s9Mailing List, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.