CVE-2021-36152 Insecure TrustManager used in LDAP connections
Apache Gobblin trusts all LDAP certificates, allowing attackers to bypass TLS validation and potentially intercept or manipulate LDAP traffic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-36152?
CVE-2021-36152 is a critical vulnerability in Apache Gobblin, published on 4 Feb 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Apache Gobblin trusts all certificates used for LDAP connections in Gobblin-as-a-Service. This affects versions <= 0.15.0. Users should update to version 0.16.0 which addresses this issue.
Which versions are affected by CVE-2021-36152?
2 open source packages ship an affected version, including org.apache.gobblin:gobblin-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.gobblin:gobblin-core Maven | All versions | 0.16.0 |
org.apache.gobblin:gobblin-core Maven | All versions | 0.16.0 |
Products include Apache Gobblin.
How do I fix CVE-2021-36152?
Upgrade org.apache.gobblin:gobblin-core to 0.16.0 or later.
Is CVE-2021-36152 being exploited?
There is no known exploitation of CVE-2021-36152 in the wild and no public exploit code.
Other vulnerabilities in Apache Gobblin
Sources
Also known as GHSA-q5rx-8c2h-5q7j.