{"id":"GHSA-3xgr-h5hq-7299","aliases":[],"url":"https://o3.security/vulnerability/GHSA-3xgr-h5hq-7299","summary":"GeoIP processor disables SSL certificate validation when downloading databases","details":"### Impact\n\nThe GeoIP processor in Data Prepper was configured to trust all SSL certificates and disable hostname verification when downloading GeoIP databases from HTTP URLs, making downloads vulnerable to man-in-the-middle attacks.\n\nThe GeoIP processor included a custom SSL implementation that completely bypassed certificate validation when downloading GeoIP databases from external sources. The `initiateSSL()` method incorrectly implemented an approach for trusting all certificates. Specifically it:\n\n* Accepted all SSL certificates without validation\n* Disabled server certificate verification\n* Disabled client certificate verification\n* Disabled hostname verification\n\nThis configuration made database downloads vulnerable to man-in-the-middle attacks, potentially allowing attackers to serve malicious GeoIP databases that could compromise the integrity of geolocation data processing.\n\n### Patches\n\nData Prepper 2.12.2 contains a fix for this issue.\n\n### Workarounds\n\nIf upgrading is not immediately possible:\n\n* Use local GeoIP database files instead of downloading from HTTP URLs\n* Ensure database downloads occur only over trusted networks","published":"2025-10-15T20:40:10Z","modified":"2025-10-16T08:10:43.220454Z","cvss":{"score":5.9,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.opensearch.dataprepper.plugins:geoip-processor","fixedVersion":"2.12.2"}],"fix":{"url":"https://github.com/opensearch-project/data-prepper/commit/b82ea0640d98d9f4c742622325faeeb6248ee135","label":"opensearch-project/data-prepper@b82ea06"},"references":[{"type":"WEB","url":"https://github.com/opensearch-project/data-prepper/security/advisories/GHSA-3xgr-h5hq-7299"},{"type":"WEB","url":"https://github.com/opensearch-project/data-prepper/commit/b82ea0640d98d9f4c742622325faeeb6248ee135"},{"type":"PACKAGE","url":"https://github.com/opensearch-project/data-prepper"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2025-10-16T08:10:43.220454Z"}}