CVE-2020-1929: Improper Certificate Validation in Apache Beam
Summary
CVE-2020-1929: Improper Certificate Validation in Apache Beam. Affects org.apache.beam:beam-sdks-java-io-mongodb versions >= 2.10.0, < 2.17.0. Fixed in 2.17.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Apache Beam MongoDB connector is a component of the Apache Beam project, which is an open-source unified programming model for batch and streaming data processing. The MongoDB connector allows users to read from and write to MongoDB databases using Apache Beam pipelines. It is commonly used in Java applications that require integration with MongoDB.
Vulnerability Detail
The Apache Beam MongoDB connector versions 2.10.0 to 2.16.0 have an improper certificate validation vulnerability. The connector provides an option to disable SSL trust verification, but this configuration is not respected. As a result, the certificate verification is disabled in all cases, compromising the trust verification process. This vulnerability affects any code running in the same JVM as the connector. An attacker could exploit this vulnerability to perform man-in-the-middle attacks, intercept sensitive data, or impersonate trusted entities.
How To Fix
Minimum fixed version
2.17.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, if upgrading to the fixed version is not immediately feasible, you can manually enforce SSL trust verification by modifying the connector's source code. Locate the code that disables trust verification and remove or modify it to enable trust verification. Here is an example of how to modify the code:
// Remove or modify the following line in the MongoDB connector source code
sslContextBuilder.loadTrustMaterial(null, (certificate, authType) -> true);
After making the necessary changes, rebuild and redeploy the modified connector.
Conclusion
The Apache Beam MongoDB connector versions 2.10.0 to 2.16.0 have an improper certificate validation vulnerability that allows SSL trust verification to be bypassed. It is recommended to upgrade to version 2.17.0 or later to fix this vulnerability. If immediate upgrade is not possible, manual modification of the connector's source code can be used as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.beam:beam-sdks-java-io-mongodb →
FAQ
This vulnerability allows an attacker to bypass SSL trust verification, compromising the integrity and confidentiality of data exchanged between the Apache Beam MongoDB connector and MongoDB databases. It can lead to man-in-the-middle attacks, data interception, and impersonation of trusted entities.
Versions 2.10.0 to 2.16.0 of the Apache Beam MongoDB connector are affected by this vulnerability.
Yes, the vulnerability has been fixed in Apache Beam MongoDB connector version 2.17.0. It is recommended to upgrade to this version or later to mitigate the vulnerability.
Yes, as a temporary workaround, you can manually modify the connector's source code to enforce SSL trust verification. However, it is strongly recommended to upgrade to the fixed version as soon as possible.
You can find more information about the vulnerability in the Apache Beam MongoDB connector advisory on the GitHub Advisory Database: [link to advisory]
