CVE-2022-32531

Published: Dec 15, 2022Modified: Jun 17, 2026

5.9

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 2.2 / Impact: 3.6

Source: NVD

Description

The Apache Bookkeeper Java Client (before 4.14.6 and also 4.15.0) does not close the connection to the bookkeeper server when TLS hostname verification fails. This leaves the bookkeeper client vulnerable to a man in the middle attack. The problem affects BookKeeper client prior to versions 4.14.6 and 4.15.1.

Affected (3)

Products: Apache: Bookkeeper

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Apache Bookkeeper	Before 4.14.6
Apache Bookkeeper	Version 4.15.0
Apache Bookkeeper	Version 4.15.0 rc0

Related CWEs

Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

References (2)

https://lists.apache.org/thread/xyk2lfc7lzof8mksmwyympbqxts1b5s9

Source: security@apache.org

Mailing ListVendor Advisory

https://lists.apache.org/thread/xyk2lfc7lzof8mksmwyympbqxts1b5s9

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListVendor Advisory

Timeline

No history available yet.