{"id":"GHSA-3xgr-h5hq-7299","aliases":[],"status":"published","title":"GeoIP processor disables SSL certificate validation when downloading databases","description":"### Impact\n\nThe GeoIP processor in Data Prepper was configured to trust all SSL certificates and disable hostname verification when downloading GeoIP databases from HTTP URLs, making downloads vulnerable to man-in-the-middle attacks.\n\nThe GeoIP processor included a custom SSL implementation that completely bypassed certificate validation when downloading GeoIP databases from external sources. The `initiateSSL()` method incorrectly implemented an approach for trusting all certificates. Specifically it:\n\n* Accepted all SSL certificates without validation\n* Disabled server certificate verification\n* Disabled client certificate verification\n* Disabled hostname verification\n\nThis configuration made database downloads vulnerable to man-in-the-middle attacks, potentially allowing attackers to serve malicious GeoIP databases that could compromise the integrity of geolocation data processing.\n\n### Patches\n\nData Prepper 2.12.2 contains a fix for this issue.\n\n### Workarounds\n\nIf upgrading is not immediately possible:\n\n* Use local GeoIP database files instead of downloading from HTTP URLs\n* Ensure database downloads occur only over trusted networks","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2025-10-15T20:40:10Z","modified":"2025-10-16T08:10:43Z","fixes":[{"ecosystem":"Maven","package":"org.opensearch.dataprepper.plugins:geoip-processor","fixed_in":["2.12.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.opensearch.dataprepper.plugins:geoip-processor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"fixed":"2.12.2"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.opensearch.dataprepper.plugins:geoip-processor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"fixed":"2.12.2"}]}],"versions":["2.12.0","2.12.1"]}],"references":[{"url":"https://github.com/opensearch-project/data-prepper/security/advisories/GHSA-3xgr-h5hq-7299","tags":["web"]},{"url":"https://github.com/opensearch-project/data-prepper/commit/b82ea0640d98d9f4c742622325faeeb6248ee135","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3xgr-h5hq-7299"},{"url":"https://github.com/opensearch-project/data-prepper","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-3xgr-h5hq-7299","title":"GeoIP processor disables SSL certificate validation when downloading databases","description":"### Impact\n\nThe GeoIP processor in Data Prepper was configured to trust all SSL certificates and disable hostname verification when downloading GeoIP databases from HTTP URLs, making downloads vulnerable to man-in-the-middle attacks.\n\nThe GeoIP processor included a custom SSL implementation that completely bypassed certificate validation when downloading GeoIP databases from external sources. The `initiateSSL()` method incorrectly implemented an approach for trusting all certificates. Specifically it:\n\n* Accepted all SSL certificates without validation\n* Disabled server certificate verification\n* Disabled client certificate verification\n* Disabled hostname verification\n\nThis configuration made database downloads vulnerable to man-in-the-middle attacks, potentially allowing attackers to serve malicious GeoIP databases that could compromise the integrity of geolocation data processing.\n\n### Patches\n\nData Prepper 2.12.2 contains a fix for this issue.\n\n### Workarounds\n\nIf upgrading is not immediately possible:\n\n* Use local GeoIP database files instead of downloading from HTTP URLs\n* Ensure database downloads occur only over trusted networks","status":"published","published":"2025-10-15T20:40:10Z","modified":"2025-10-15T20:40:10Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:39:01.677422Z"}],"osv":[{"id":"GHSA-3xgr-h5hq-7299","title":"GeoIP processor disables SSL certificate validation when downloading databases","description":"### Impact\n\nThe GeoIP processor in Data Prepper was configured to trust all SSL certificates and disable hostname verification when downloading GeoIP databases from HTTP URLs, making downloads vulnerable to man-in-the-middle attacks.\n\nThe GeoIP processor included a custom SSL implementation that completely bypassed certificate validation when downloading GeoIP databases from external sources. The `initiateSSL()` method incorrectly implemented an approach for trusting all certificates. Specifically it:\n\n* Accepted all SSL certificates without validation\n* Disabled server certificate verification\n* Disabled client certificate verification\n* Disabled hostname verification\n\nThis configuration made database downloads vulnerable to man-in-the-middle attacks, potentially allowing attackers to serve malicious GeoIP databases that could compromise the integrity of geolocation data processing.\n\n### Patches\n\nData Prepper 2.12.2 contains a fix for this issue.\n\n### Workarounds\n\nIf upgrading is not immediately possible:\n\n* Use local GeoIP database files instead of downloading from HTTP URLs\n* Ensure database downloads occur only over trusted networks","status":"published","published":"2025-10-15T20:40:10Z","modified":"2025-10-16T08:10:43.220454Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:46:36.092962Z"}]}}