CVE-2020-13955: Missing Authentication for Critical Function in Apache Calcite

Background

Apache Calcite is a dynamic data management framework that provides a SQL interface for building and executing relational algebra queries. It is widely used in various applications and supports integration with different data sources. However, a vulnerability has been identified in Apache Calcite versions prior to 1.26.0 that could lead to information leakage and potential man-in-the-middle attacks.

Vulnerability Detail

The vulnerability (CVE-2020-13955) stems from the "HttpUtils#getURLConnection" method in Apache Calcite, which disables hostname verification for HTTPS connections. This means that clients using Calcite adapters for Druid and Splunk, as well as other applications utilizing this method, may be vulnerable to man-in-the-middle attacks. An attacker could intercept and manipulate the communication between the client and the server, potentially leading to unauthorized access or data leakage. The issue has been addressed in Apache Calcite 1.26.0, where hostname verification is performed using the default JVM truststore.

Workaround

If upgrading to the latest version is not immediately feasible, a temporary workaround is to manually enable hostname verification for HTTPS connections in the affected application. This can be done by modifying the code that uses the "HttpUtils#getURLConnection" method to explicitly enable hostname verification. Here is an example of how to enable hostname verification using the HttpsURLConnection class:

import javax.net.ssl.HttpsURLConnection;

// ... code snippet ...

HttpsURLConnection connection = (HttpsURLConnection) url.openConnection();
connection.setHostnameVerifier((hostname, session) -> true);

// ... continue with the connection setup ...

Please note that this workaround should only be considered as a temporary solution until the application can be upgraded to a fixed version.

Conclusion

In conclusion, the vulnerability (CVE-2020-13955) in Apache Calcite exposes applications to potential man-in-the-middle attacks and information leakage. It is crucial to upgrade to Apache Calcite version 1.26.0 or later to mitigate this vulnerability. If immediate upgrade is not possible, applying the provided workaround can help protect the application temporarily. For further assistance and support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for org.apache.calcite:calcite-core →

FAQ