Improper Certificate Validation in Apache Beam · CVE-2020-1929 · GitHub Advisory Database · GitHub

Improper Certificate Validation in Apache Beam

High severity GitHub Reviewed Published May 6, 2020 to the GitHub Advisory Database • Updated Jan 9, 2023

Package

org.apache.beam:beam-sdks-java-io-mongodb (Maven)

Affected versions

>= 2.10.0, <= 2.16.0

Patched versions

2.17.0

Description

The Apache Beam MongoDB connector in versions 2.10.0 to 2.16.0 has an option to disable SSL trust verification. However this configuration is not respected and the certificate verification disables trust verification in every case. This exclusion also gets registered globally which disables trust checking for any code running in the same JVM.

References

Reviewed May 6, 2020

Published to the GitHub Advisory Database May 6, 2020

Last updated Jan 9, 2023

Severity

High

7.5

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N