CVE-2020-1929 — Improper Certificate Validation in Apache Beam

CWE-295 — Improper Certificate Validation4 documents4 sources
Severity
7.5HIGHNVD
EPSS
0.4%
top 39.27%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Apache Beam
Timeline
PublishedJan 15
Latest updateMay 6

Description

The Apache Beam MongoDB connector in versions 2.10.0 to 2.16.0 has an option to disable SSL trust verification. However this configuration is not respected and the certificate verification disables trust verification in every case. This exclusion also gets registered globally which disables trust checking for any code running in the same JVM.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶NVDapache/beam2.10.0 — 2.16.0
▶CVEListV5apache/beam2.10.0 to 2.16.0

🔴Vulnerability Details

3
GHSA
Improper Certificate Validation in Apache Beam↗2020-05-06
▶
OSV
Improper Certificate Validation in Apache Beam↗2020-05-06
▶
CVEList
CVE-2020-1929: The Apache Beam MongoDB connector in versions 2↗2020-01-15
▶
CVE-2020-1929 — Improper Certificate Validation | cvebase