PT-2021-13887 · Unknown · Java Driver

Jeffrey Yemin + 1 · Published 2021-02-25 · Updated 2024-09-16 · CVE-2021-20328

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Java driver versions that support client-side field level encryption (CSFLE)

Description: The issue arises from the Java driver's failure to perform correct host name verification on the KMS server's certificate, which, in combination with a privileged network position active MITM attack, could result in interception of traffic between the Java driver and the KMS service. This renders Field Level Encryption ineffective. The Java async, Scala, and reactive streams drivers are not impacted. Additionally, this issue does not affect driver traffic payloads with CSFLE-supported key services originating from applications inside the AWS, GCP, and Azure network fabrics due to existing controls in these environments. It also does not impact driver workloads that do not use Field Level Encryption.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2021-20328

GHSA-RGHW-6PX2-FGWC

Affected Products

Java Driver

References · 10

• https://osv.dev/vulnerability/GHSA-rghw-6px2-fgwc · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-20328 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-20328 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-20328 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-20328 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-20328 · Security Note
• https://jira.mongodb.org/browse/JAVA-4017 · Vendor Advisory
• https://t.me/cibsecurity/24143 · Telegram Post
• https://t.me/cvenotify/10519 · Telegram Post
• https://t.me/cvenotify/94799 · Telegram Post