PT-2023-12920 · Unknown · Sls-Logging

Published 2023-02-16 · Updated 2023-02-27 · CVE-2022-27890

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions sls-logging (affected versions not specified)

Description The issue arises from the misuse of the javax.net.ssl.SSLSocketFactory API, which fails to verify hostnames in TLS certificates. This could allow a malicious attacker in a privileged network position to perform a man-in-the-middle attack, enabling them to intercept, read, or modify network communications to and from the affected service. In the context of AtlasDB, the vulnerability is mitigated by other network controls such as two-way TLS when deployed as part of a Palantir platform.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Weakness Enumeration

CWE-295

CWE-297

Related Identifiers

CVE-2022-27890

Affected Products

Sls-Logging

References · 4

• https://github.com/palantir/security-bulletins/blob/main/PLTRSEC-2022-15.md · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27890 · Security Note
• https://osv.dev/vulnerability/CVE-2022-27890 · Vendor Advisory
• https://t.me/cibsecurity/58321 · Telegram Post