CVE Feed

    Dashboard / CVE / CVE-2022-32531

    CVE-2022-32531

    The Apache Bookkeeper Java Client (before 4.14.6 and also 4.15.0) does not close the connection to the bookkeeper server when TLS hostname verification fails. This leaves the bookkeeper client vulnerable to a man in the middle attack. The problem affects BookKeeper client prior to versions 4.14.6 and 4.15.1.

    Published:Dec 15, 2022
    Last Modified:Apr 17, 2025
    EPS:Dec 15, 2022
    EPSS Score:0.00143
    CVSS Score:5.9

    Affected Products

    Vendor
    Apache
    Product
    Bookkeeper

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-295 Improper Certificate Validation

    Related CVEs

    CVE-2020-23922 (CVSS 7.1) — An issue was discovered in giflib through 5.1.4. DumpScreen2RGB in gif2rgb.c has a heap-based buffer over-read…
    CVE-2020-36230 (CVSS 7.5) — A flaw was discovered in OpenLDAP before 2.4.57 leading in an assertion failure in slapd in the X.509 DN parsi…
    CVE-2019-19924 (CVSS 5.3) — SQLite 3.30.1 mishandles certain parser-tree rewriting, related to expr.c, vdbeaux.c, and window.c. This is ca…
    CVE-2019-17571 (CVSS 9.8) — Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which ca…
    CVE-2019-19906 (CVSS 7.5) — cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-serv…
    CVE-2017-6891 (CVSS 8.8) — Two errors in the "asn1_find_node()" function (lib/parser_aux.c) within GnuTLS libtasn1 version 4.10 can be ex…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High