CVE-2022-32531 Apache BookKeeper: Java Client Uses Connection to Host that Failed Hostname Verification

What is CVE-2022-32531?

CVE-2022-32531 is a medium-severity vulnerability in Apache BookKeeper, published on 15 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Apache Bookkeeper Java Client (before 4.14.6 and also 4.15.0) does not close the connection to the bookkeeper server when TLS hostname verification fails. This leaves the bookkeeper client vulnerable to a man in the middle attack.

The problem affects BookKeeper client prior to versions 4.14.6 and 4.15.1.

Weakness: CWE-295

Which versions are affected by CVE-2022-32531?

5 open source packages ship an affected version, including org.apache.bookkeeper:bookkeeper-common and apache-bookkeeper-client. It affects 1 product.

Products include Apache Bookkeeper.

How do I fix CVE-2022-32531?

Upgrade org.apache.bookkeeper:bookkeeper-common to a fixed version for your release line: 4.14.6 or 4.15.1.

Is CVE-2022-32531 being exploited?

There is no known exploitation of CVE-2022-32531 in the wild and no public exploit code.

Other vulnerabilities in Apache BookKeeper

• CVE-2019-17571 Deserialization of Untrusted Data in Log4j Critical 9.8
• CVE-2017-6891 Memory corruption in GnuTLS libtasn1 High 8.8
• CVE-2020-36230 A flaw was discovered in OpenLDAP before 2.4.57 leading in an assertion failure in slapd in the X.509 DN parsing in decode.c ber_next_elemen High 7.5
• CVE-2019-19906 Memory corruption in n/a High 7.5
• CVE-2020-23922 Memory corruption in n/a High 7.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-gxq5-79m2-gvvq, PYSEC-2022-43060, UBUNTU-CVE-2022-32531.