CVE-2022-27890

It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack would allow them to intercept, read, or modify network communications to and from the affected service. In the case of AtlasDB, the vulnerability was mitigated by other network controls such as two-way TLS when deployed as part of a Palantir platform. Palantir still recommends upgrading to a non-vulnerable version out of an abundance of caution.
Configurations

Configuration 1 (hide)

cpe:2.3:a:palantir:atlasdb:*:*:*:*:*:*:*:*

History

21 Nov 2024, 06:56

Type Values Removed Values Added
References () https://github.com/palantir/security-bulletins/blob/main/PLTRSEC-2022-15.md - Vendor Advisory () https://github.com/palantir/security-bulletins/blob/main/PLTRSEC-2022-15.md - Vendor Advisory
CVSS v2 : unknown
v3 : 7.4
v2 : unknown
v3 : 6.3

Information

Published : 2023-02-16 16:15

Updated : 2024-11-21 06:56


NVD link : CVE-2022-27890

Mitre link : CVE-2022-27890

CVE.ORG link : CVE-2022-27890


JSON object : View

Products Affected

palantir

  • atlasdb
CWE
CWE-297

Improper Validation of Certificate with Host Mismatch

CWE-295

Improper Certificate Validation