https://seclists.org/oss-sec/2024/q1/145: CVE-2023-49250: Apache DolphinScheduler: Insecure TLS TrustManager used in HttpUtil
Published Feb 20, 2024
·Updated
Affected Software
1 affected component
Apache Dolphinscheduler<3.2.0
Frequently Asked Questions
1
What is the severity of CVE-2023-49250?
The severity of CVE-2023-49250 is classified as low.
2
How do I fix CVE-2023-49250?
To fix CVE-2023-49250, upgrade to Apache DolphinScheduler version 3.2.1 or later, which includes proper certificate verification in HttpUtil.
3
What versions of Apache DolphinScheduler are affected by CVE-2023-49250?
Apache DolphinScheduler versions up to and including 3.2.0 are affected by CVE-2023-49250.
4
What kind of attack can exploit CVE-2023-49250?
CVE-2023-49250 can be exploited through a Man-in-the-Middle (MITM) attack on outgoing HTTPS connections.
5
What is the impact of CVE-2023-49250 on Apache DolphinScheduler?
The impact of CVE-2023-49250 allows an attacker to impersonate the server due to the lack of certificate verification in the HttpUtils class.