Security Flaw in Apache Calcite Affects Druid and Splunk Connectivity

CVE-2020-13955

Summary

A vulnerability exists in the HttpUtils#getURLConnection method of Apache Calcite, which disables hostname verification for HTTPS connections. This flaw exposes clients to man-in-the-middle attacks, compromising data security during interactions with Druid and Splunk through their relevant Calcite adapters. As a result, sensitive information may be leaked. From version 1.26 onward, Apache Calcite addresses this issue by enabling hostname verification using the default JVM truststore, thus enhancing connection security.

References