CVE-2022-32531: Apache Bookkeeper Java Client TLS Hostname Verification Bypass
Summary
CVE-2022-32531: The Apache Bookkeeper Java Client (before 4.14.6 and also 4.15.0) does not close the connection to the bookkeeper server when TLS hostname verification fails. Affects apache-bookkeeper-client versions < 4.14.6. Fixed in 4.14.6. How to fix ↓
Also tracked for
The same CVE-2022-32531 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Apache Bookkeeper Java Client is a library that provides a Java interface for interacting with the Apache Bookkeeper server. Apache Bookkeeper is a scalable, fault-tolerant, and low-latency storage service optimized for write-intensive workloads. The Java Client allows applications to read and write data to the Bookkeeper server using a secure TLS connection. However, prior to versions 4.14.6 and 4.15.1, the client does not properly close the connection when TLS hostname verification fails, leaving it vulnerable to a man-in-the-middle attack.
Vulnerability Detail
The vulnerability in the Apache Bookkeeper Java Client allows an attacker to perform a man-in-the-middle attack by exploiting the failure to close the connection when TLS hostname verification fails. This means that an attacker could intercept and modify the communication between the client and the Bookkeeper server, potentially leading to unauthorized access, data tampering, or other malicious activities. The vulnerability has a CVSSv3 score of 5.9, indicating a moderate severity.
How To Fix
Minimum fixed version
4.14.6
This is the first release that contains the fix.
pip install --upgrade "apache-bookkeeper-client==4.14.6"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable TLS hostname verification in the client configuration. However, this workaround should only be used as a temporary measure and not as a long-term solution. To disable TLS hostname verification, users can modify the client configuration to set the 'tlsHostnameVerification' property to 'false'. Here is an example of how to disable TLS hostname verification in the Bookkeeper client:
ClientConfiguration conf = new ClientConfiguration();
conf.setTLSHostnameVerification(false);
BookKeeper bk = new BookKeeper(conf);
It is important to note that disabling TLS hostname verification can expose the client to potential security risks and should be done with caution.
Conclusion
The Apache Bookkeeper Java Client is vulnerable to a TLS hostname verification bypass, which can lead to a man-in-the-middle attack. To mitigate this vulnerability, it is recommended to upgrade to version 4.14.6 or later. Alternatively, users can temporarily disable TLS hostname verification, but this should only be done as a short-term measure. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for apache-bookkeeper-client →
FAQ
This vulnerability allows an attacker to perform a man-in-the-middle attack and potentially gain unauthorized access, tamper with data, or carry out other malicious activities.
The vulnerability affects Apache Bookkeeper Java Client versions prior to 4.14.6 and 4.15.1.
Yes, upgrading to Apache Bookkeeper Java Client version 4.14.6 or later fixes this vulnerability.
Yes, it is possible to disable TLS hostname verification in the client configuration as a temporary workaround. However, this should only be done temporarily and not as a long-term solution.
The CVSSv3 score of this vulnerability is 5.9, indicating a moderate severity.
