CVE-2019-10091: High severity apache geode vulnerability
When TLS is enabled with ssl-endpoint-identification-enabled set to true, Apache Geode fails to perform hostname verification of the entries in the certificate SAN during the SSL handshake. This could compromise intra-cluster communication using a man-in-the-middle attack.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-10091?
CVE-2019-10091 is a vulnerability in Apache Geode that occurs when TLS is enabled with ssl-endpoint-identification-enabled set to true, which causes the failure of hostname verification during the SSL handshake.
How does CVE-2019-10091 affect Apache Geode?
CVE-2019-10091 affects Apache Geode by compromising intra-cluster communication through a man-in-the-middle attack.
What is the severity level of CVE-2019-10091?
The severity level of CVE-2019-10091 is high with a CVSS score of 7.4.
Which versions of Apache Geode are affected by CVE-2019-10091?
Apache Geode versions 1.9.0 and 1.10.0 (up to exclusive) are affected by CVE-2019-10091.
How can I fix CVE-2019-10091?
To fix CVE-2019-10091, upgrade to Apache Geode version 1.10.0 or later.