CVE-2023-49250: Apache DolphinScheduler: Insecure TLS TrustManager used in HttpUtil
Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle (MITM) attack on outgoing https connections could impersonate the server.
This issue affects Apache DolphinScheduler: before 3.2.0.
Users are recommended to upgrade to version 3.2.1, which fixes the issue.
Other sources
Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle (MITM) attack on outgoing https connections could impersonate the server.
This issue affects Apache DolphinScheduler: before 3.2.1.
Users are recommended to upgrade to version 3.2.1, which fixes the issue.
— GitHub
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-49250?
CVE-2023-49250 is classified as a high severity vulnerability due to the potential for Man-in-the-Middle attacks.
How do I fix CVE-2023-49250?
To fix CVE-2023-49250, users should upgrade Apache DolphinScheduler to version 3.2.1 or later.
What software is affected by CVE-2023-49250?
CVE-2023-49250 affects Apache DolphinScheduler versions prior to 3.2.0.
What type of attack is possible with CVE-2023-49250?
CVE-2023-49250 allows attackers to perform a Man-in-the-Middle attack by impersonating the server.
What is the issue with the HttpUtils class in CVE-2023-49250?
The HttpUtils class in CVE-2023-49250 failed to verify certificates, enabling potential MITM attacks.