Unscored CVE-2020-17514 EUVD-2020-9459GHSA-qwv7-pm3r-wfcw

disabled hostname verificiation

Published May 27, 2021 · Updated Aug 4, 2024 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Fineract

Description

Apache Fineract prior to 1.5.0 disables HTTPS hostname verification in ProcessorHelper in the configureClient method. Under typical deployments, a man in the middle attack could be successful.

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache Fineract	Apache Fineract – < 1.5.0	1.5.0

References

https://issues.apache.org/jira/browse/FINERACT-1211
[fineract-dev] 20210527 Re: Release 1.5.0 fixed security issue CVE-2020-17514 mailing-list
[oss-security] 20210527 CVE-2020-17514: Apache Fineract: Disabled hostname verification for HTTPS mailing-list