CVE-2019-10091

published 2020-03-16

CVE-2019-10091: When TLS is enabled with ssl-endpoint-identification-enabled set to true, Apache Geode fails to perform hostname verification of the entries in the certificate…

high 7.4 CVSS 3.1

AV N AC H PR N UI N S U C H I H A N

When TLS is enabled with ssl-endpoint-identification-enabled set to true, Apache Geode fails to perform hostname verification of the entries in the certificate SAN during the SSL handshake. This could compromise intra-cluster communication using a man-in-the-middle attack.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
apache	geode	—	—

CWE-295