CVE-2022-32531— Apache BookKeeper: Java Client Uses Connection to Host that Failed Hostname Verification
Quick assessment
Affected
Apache Software Foundation Apache BookKeeper
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache BookKeeper是美国阿帕奇（Apache）基金会的一个针对实时工作负载优化的可扩展、容错和低延迟存储服务。 Apache Bookkeeper Java Client 4.14.6 之前版本和 4.15.0 之前版本存在信任管理问题漏洞，该漏洞源于当 TLS 主机名验证失败时，不会关闭与簿记服务器的连接， 这使得簿记员客户端容易受到中间人攻击。
Possible ATT&CK Techniques 1 AI
T1041 · Exfiltration Over C2 Channel
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-32531
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache BookKeeper: Java Client Uses Connection to Host that Failed Hostname Verification
Source: CVE Program / CVE List V5
Vulnerability Description
The Apache Bookkeeper Java Client (before 4.14.6 and also 4.15.0) does not close the connection to the bookkeeper server when TLS hostname verification fails. This leaves
the bookkeeper client vulnerable to a man in the middle attack.
The problem affects BookKeeper client prior to versions 4.14.6 and 4.15.1.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
证书验证不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Apache BookKeeper 信任管理问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache BookKeeper是美国阿帕奇（Apache）基金会的一个针对实时工作负载优化的可扩展、容错和低延迟存储服务。 Apache Bookkeeper Java Client 4.14.6 之前版本和 4.15.0 之前版本存在信任管理问题漏洞，该漏洞源于当 TLS 主机名验证失败时，不会关闭与簿记服务器的连接， 这使得簿记员客户端容易受到中间人攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache BookKeeper | 0 ~ 4.14.5 | - |
|
II. Public POCs for CVE-2022-32531
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-32531
请登录查看更多情报信息。
Mailing List Discussions for CVE-2022-32531 (1)
-
https://lists.apache.org/thread/xyk2lfc7lzof8mksmwyympbqxts1b5s9 vendor-advisory
IV. Related Vulnerabilities
Same vendor: Apache Software Foundation
-
CVE-2026-59654
Apache CloudStack: DoS caused by database connections leak -
CVE-2026-63046
Apache InLong: Agent Installer — Command Injection to RCE vi -
CVE-2026-47359
Apache CloudStack: OS Command Injection due to unsanitized m -
CVE-2026-50112
Apache CloudStack: RCE and SSRF in direct download, metalink -
CVE-2026-50222
Apache CloudStack: Improper access control in Userdata refer
Same weakness: CWE-295
-
CVE-2026-17024
Vulnerabilities in IBM AIX and PowerVM VIOS -
CVE-2026-53583
libgit2: Inverted IP SubjectAltName Comparison in OpenSSL Ba -
CVE-2026-73253
Mongoose: TLS Hostname Verification Bypass via Overly Permis -
CVE-2026-73251
Mongoose Built-in TLS: CA-bundle certificate chain accepted -
CVE-2026-76403
Improper Certificate Validation through HTTP Event Collector
V. Comments for CVE-2022-32531
No comments yet