CVE-2022-32531
2 advisories.
PyPI/apache-bookkeeper-client CVE-2022-32531: medium 5.9, EPSS 1.09%
The Apache Bookkeeper Java Client (before 4.14.6 and also 4.15.0) does not close the connection to the bookkeeper server when TLS hostname verification fails. This leaves
Action: Upgrade apache-bookkeeper-client to 4.14.6 or later.
pip install apache-bookkeeper-client==4.14.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 4.14.6 | - |
Fixed versions
| 4.14.6 |
Sources
CVE-2022-32531 · published · modified · JSON
Maven/org.apache.bookkeeper:bookkeeper-common CVE-2022-32531: medium 5.9
Apache Bookkeeper vulnerable to Improper Certificate Validation
Action: Upgrade org.apache.bookkeeper:bookkeeper-common to 4.14.6 (4.14.x) or 4.15.1 (4.15.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 4.14.6 | - |
| 4.15.0 | 4.15.1 | - |
Fixed versions
| 4.14.6 | 4.15.1 |
Sources
- osv: GHSA-gxq5-79m2-gvvq
- https://nvd.nist.gov/vuln/detail/CVE-2022-32531
- https://github.com/apache/bookkeeper
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-bookkeeper-client/PYSEC-2022-43060.yaml
- https://lists.apache.org/thread/xyk2lfc7lzof8mksmwyympbqxts1b5s9
CVE-2022-32531 · published · modified · JSON