Skip to content
Sign in
Not rated

CVE-2019-10091 When TLS is enabled with ssl-endpoint-identification-enabled set to true, Apache Geode fails to perform hostname…

Description

When TLS is enabled with ssl-endpoint-identification-enabled set to true, Apache Geode fails to perform hostname verification of the entries in the certificate SAN during the SSL handshake. This could compromise intra-cluster communication using a man-in-the-middle attack.

Affected products and versions

Product Affected versions Fixed in
Apache Geode Versions not published

Other CVEs of Apache Geode

The 2 CVEs of Apache Geode →
CVE-2017-15694 When an Apache Geode server versions 1.0.0 to 1.8.0 is operating in secure mode, a user with write permissions for… Not rated
Track this CVE