CVE-2021-36152: Apache Gobblin LDAP Certificate Trust Vulnerability
Summary
CVE-2021-36152: Apache Gobblin trusts all certificates used for LDAP connections in Gobblin-as-a-Service. Affects org.apache.gobblin:gobblin-core versions < 0.16.0. Fixed in 0.16.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Gobblin is an open-source distributed data integration framework used for ingesting, transforming, and delivering large volumes of data. It provides a unified interface for data ingestion from various sources and supports data integration with Apache Kafka, Hadoop, and other systems. Gobblin-as-a-Service is a component of Apache Gobblin that allows users to run Gobblin jobs as a service. This vulnerability affects versions 0.15.0 and below of the Gobblin core package.
Vulnerability Detail
The vulnerability in Apache Gobblin allows for the trust of all certificates used for LDAP connections in Gobblin-as-a-Service. This means that any certificate, regardless of its validity or authenticity, will be trusted by the application. An attacker could exploit this vulnerability by presenting a malicious certificate, leading to potential man-in-the-middle attacks or unauthorized access to LDAP resources. The impact of this vulnerability is critical, as it compromises the security and integrity of LDAP connections within Gobblin-as-a-Service.
How To Fix
Minimum fixed version
0.16.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The Apache Gobblin LDAP Certificate Trust Vulnerability in Gobblin-as-a-Service poses a critical risk to the security and integrity of LDAP connections. Users are strongly advised to update their Gobblin core package to version 0.16.0 or above to address this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.gobblin:gobblin-core →
FAQ
Apache Gobblin is an open-source distributed data integration framework used for ingesting, transforming, and delivering large volumes of data. It provides a unified interface for data ingestion from various sources and supports integration with Apache Kafka, Hadoop, and other systems.
Gobblin-as-a-Service is a component of Apache Gobblin that allows users to run Gobblin jobs as a service. It provides a scalable and managed environment for executing Gobblin data integration tasks.
This vulnerability allows for the trust of all certificates used for LDAP connections in Gobblin-as-a-Service. It means that any certificate, regardless of its validity or authenticity, will be trusted by the application. This compromises the security and integrity of LDAP connections, potentially leading to man-in-the-middle attacks or unauthorized access to LDAP resources.
The severity of this vulnerability is critical, with a CVSS score of 9.8. It poses a significant risk to the security and integrity of LDAP connections within Gobblin-as-a-Service.
To fix this vulnerability, users should update their Gobblin core package to version 0.16.0 or above. The updated version implements proper certificate validation for LDAP connections, mitigating the risk of unauthorized access or man-in-the-middle attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.gobblin:gobblin-core.
