CVE-2023-4586 — Hotrod-client: hot rod client does not enable hostname validation when using tls that lead to a mitm attack

CVE-2023-4586

Hotrod-client: hot rod client does not enable hostname validation when using tls that lead to a mitm attack PUBLISHED

Description (CNA)

A vulnerability was found in the Hot Rod client. This security issue occurs as the Hot Rod client does not enable hostname validation when using TLS, possibly resulting in a man-in-the-middle (MITM) attack.

Affected (CNA)

Vendor / product	Versions
Red Hat / Red Hat Data Grid 8.4.6	unaffected

CWE

CWE-20

References

https://access.redhat.com/errata/RHSA-2023:7676
https://access.redhat.com/security/cve/CVE-2023-4586
https://bugzilla.redhat.com/show_bug.cgi?id=2235564

ADP enrichment

CVE

No English description supplied.

https://access.redhat.com/errata/RHSA-2023:7676
https://access.redhat.com/security/cve/CVE-2023-4586
https://bugzilla.redhat.com/show_bug.cgi?id=2235564