Apache Beam vulnerabilities

2 known vulnerabilities affecting apache/beam.

Total CVEs

2

CISA KEV

0

Public exploits

0

Exploited in wild

0

Severity breakdown

HIGH2

Vulnerabilities

Page 1 of 1

CVE-2020-27216HIGHCVSS 7.0v2.21.0v2.22.0+3 more2020-10-23

CVE-2020-27216 [HIGH] CWE-378 CVE-2020-27216: In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alp In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to comp

CVE-2020-1929HIGHCVSS 7.5≥ 2.10.0, ≤ 2.16.0v2.10.0 to 2.16.02020-01-15

CVE-2020-1929 [HIGH] CWE-295 CVE-2020-1929: The Apache Beam MongoDB connector in versions 2.10.0 to 2.16.0 has an option to disable SSL trust ve The Apache Beam MongoDB connector in versions 2.10.0 to 2.16.0 has an option to disable SSL trust verification. However this configuration is not respected and the certificate verification disables trust verification in every case. This exclusion also gets registered globally which disables trust checking for any code running in the same JVM.