CVE-2019-10091: Improper Certificate Validation in Apache Geode
Summary
CVE-2019-10091: Apache Geode SSL endpoint verification vulnerability. Affects org.apache.geode:geode-core versions < 1.10.0. Fixed in 1.10.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Geode is an open-source, distributed, in-memory data grid that provides high-performance data management and caching capabilities. It is commonly used for large-scale data processing and analytics. The vulnerability in question arises when TLS is enabled with ssl-endpoint-identification-enabled set to true. In this configuration, Apache Geode fails to perform hostname verification of the entries in the certificate SAN during the SSL handshake. This flaw could potentially allow an attacker to carry out a man-in-the-middle attack, compromising the security of intra-cluster communication.
Vulnerability Detail
The vulnerability (CVE-2019-10091) in Apache Geode stems from the improper validation of certificates during the SSL handshake. When ssl-endpoint-identification-enabled is enabled, Geode does not properly verify the hostname in the certificate SAN (Subject Alternative Name) field. This oversight opens up the possibility of an attacker intercepting and tampering with intra-cluster communication. By exploiting this vulnerability, an attacker could potentially gain unauthorized access to sensitive data or manipulate the communication within the cluster.
How To Fix
Latest published version: 2.0.3 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.10.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the ssl-endpoint-identification-enabled configuration option. This can be done by setting the value to false in the Geode configuration file. However, it is important to note that this workaround may introduce potential security risks, as it disables hostname verification. Therefore, it is strongly recommended to upgrade to the latest version as soon as possible.
Conclusion
In conclusion, the vulnerability (CVE-2019-10091) in Apache Geode exposes a weakness in the hostname verification process during the SSL handshake. This could potentially allow an attacker to intercept and manipulate intra-cluster communication. To mitigate this vulnerability, it is crucial to upgrade to Apache Geode version 1.12.0 or later. Alternatively, a temporary workaround is available by disabling the ssl-endpoint-identification-enabled configuration option, although this introduces potential security risks. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.geode:geode-core →
FAQ
Apache Geode is an open-source, distributed, in-memory data grid that provides high-performance data management and caching capabilities. It is commonly used for large-scale data processing and analytics.
This vulnerability could allow an attacker to carry out a man-in-the-middle attack, compromising the security of intra-cluster communication in Apache Geode deployments.
To fix this vulnerability, it is recommended to upgrade to Apache Geode version 1.12.0 or later. This version includes the necessary fixes to properly validate the hostname in the certificate SAN during the SSL handshake.
A temporary workaround is to disable the ssl-endpoint-identification-enabled configuration option. However, this may introduce potential security risks, and it is strongly recommended to upgrade to the latest version instead.
For more information about this vulnerability, you can refer to the CVE-2019-10091 advisory or the Apache Geode documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.geode:geode-core.
