VULNERABILITY INTELLIGENCE

CVE-2022-32531

CVSS score5.9 MEDIUM
EPSS probability1.09%
CISA KEVNot currently listed
Published2022-12-15
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Description

The Apache Bookkeeper Java Client (before 4.14.6 and also 4.15.0) does not close the connection to the bookkeeper server when TLS hostname verification fails. This leaves the bookkeeper client vulnerable to a man in the middle attack. The problem affects BookKeeper client prior to versions 4.14.6 and 4.15.1.

Weakness classification

  • security@apache.org: CWE-295

Primary references