CVE-2022-32531

Name of the Vulnerable Software and Affected Versions Apache Bookkeeper Java Client versions prior to 4.14.6 and 4.15.1

Description The Apache Bookkeeper Java Client does not close the connection to the bookkeeper server when TLS hostname verification fails, leaving it vulnerable to a man-in-the-middle attack.

Recommendations For versions prior to 4.14.6 and 4.15.1, update to version 4.14.6 or 4.15.1 or later to resolve the issue. As a temporary workaround, consider disabling TLS connections to the bookkeeper server until a patch is applied. Restrict access to the bookkeeper server to minimize the risk of exploitation.