CVE-2023-49250
Assigner: apache
Published: 2024-02-20T10:00:06.733Z
State: PUBLISHED
affected: collectionURL: https://repo.maven.apache.org/maven2
defaultStatus: unaffected
packageName: org.apache.dolphinscheduler:dolphinscheduler-common
product: Apache DolphinScheduler
vendor: Apache Software Foundation
versions: lessThanOrEqual: 3.2.0
status: affected
version: 0
versionType: semver
descriptions: supportingMedia: base64: no
type: text/html
value: <p><span style="background-color: rgb(255, 255, 255);">Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle (MITM) attack on outgoing https connections could impersonate the server.</span><br></p><p>This issue affects Apache DolphinScheduler: before 3.2.0.</p><p>Users are recommended to upgrade to version 3.2.1, which fixes the issue.</p><br>
value: Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle (MITM) attack on outgoing https connections could impersonate the server.

This issue affects Apache DolphinScheduler: before 3.2.0.

Users are recommended to upgrade to version 3.2.1, which fixes the issue.


metrics: other: content: text: low
type: Textual description of severity
problemTypes: descriptions: cweId: CWE-295
description: CWE-295 Improper Certificate Validation
type: CWE
source: discovery: UNKNOWN
title: Apache DolphinScheduler: Insecure TLS TrustManager used in HttpUtil
x_generator: engine: Vulnogram 0.1.0-dev