CVE-2022-27890 Weak cryptography in AtlasDB
A library fails to verify TLS hostnames, allowing attackers in privileged network positions to intercept or modify communications via man-in-the-middle attacks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-27890?
CVE-2022-27890 is a medium-severity vulnerability in Palantir AtlasDB, published on 16 Feb 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack would allow them to intercept, read, or modify network communications to and from the affected service. In the case of AtlasDB, the vulnerability was mitigated by other network controls such as two-way TLS when deployed as part of a Palantir platform. Palantir still recommends upgrading to a non-vulnerable version out of an abundance of caution.
Which versions are affected by CVE-2022-27890?
It affects 1 product.
Products include Palantir Atlasdb.
How do I fix CVE-2022-27890?
No fix has been published for CVE-2022-27890 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-27890 being exploited?
There is no known exploitation of CVE-2022-27890 in the wild and no public exploit code.
Sources
Also known as GHSA-v8rr-9cww-2334.