Bug#1026233: bookkeeper: CVE-2022-32531

[Moritz Mühlenhoff]

Source: bookkeeper
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerability was published for bookkeeper.

CVE-2022-32531[0]:
| The Apache Bookkeeper Java Client (before 4.14.6 and also 4.15.0) does
| not close the connection to the bookkeeper server when TLS hostname
| verification fails. This leaves the bookkeeper client vulnerable to a
| man in the middle attack. The problem affects BookKeeper client prior
| to versions 4.14.6 and 4.15.1.

https://lists.apache.org/thread/xyk2lfc7lzof8mksmwyympbqxts1b5s9

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2022-32531
    https://www.cve.org/CVERecord?id=CVE-2022-32531

Please adjust the affected versions in the BTS as needed.