CVE-2025-62371 (CNNVD-202510-2097)
中文标题:
OpenSearch Data Prepper 信任管理问题漏洞
英文标题:
OpenSearch Data Prepper plugins trusts all SSL certificates by default
漏洞描述
中文描述:
OpenSearch Data Prepper是OpenSearch开源的一个 OpenSearch 项目的组件 OpenSearch Data Prepper 2.12.2之前版本存在信任管理问题漏洞，该漏洞源于OpenSearch sink和source插件默认信任所有SSL证书，可能导致中间人攻击。
英文描述:
OpenSearch Data Prepper as an open source data collector for observability data. In versions prior to 2.12.2, the OpenSearch sink and source plugins in Data Prepper trust all SSL certificates by default when no certificate path is provided. Prior to this fix, the OpenSearch sink and source plugins would automatically use a trust all SSL strategy when connecting to OpenSearch clusters if no certificate path was explicitly configured. This behavior bypasses SSL certificate validation, potentially allowing attackers to intercept and modify data in transit through man-in-the-middle attacks. The vulnerability affects connections to OpenSearch when the cert parameter is not explicitly provided. This issue has been patched in version 2.12.2. As a workaround, users can add the cert parameter to their OpenSearch sink or source configuration with the path to the cluster's CA certificate.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| opensearch-project | data-prepper | < 2.12.2 | - | - |
cpe:2.3:a:opensearch-project:data-prepper:<_2.12.2:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
参考链接
cve.org
cve.org
cve.org
cve.org
CVSS评分详情
3.1 (cna)
HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2025-62371 |
2025-11-11 15:23:33 | 2025-11-11 07:40:48 |
| NVD | nvd_CVE-2025-62371 |
2025-11-11 15:01:06 | 2025-11-11 07:48:35 |
| CNNVD | cnnvd_CNNVD-202510-2097 |
2025-11-11 15:12:59 | 2025-11-11 08:00:17 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 信任管理问题
- cnnvd_id: 未提取 -> CNNVD-202510-2097
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- data_sources: ['cve'] -> ['cve', 'nvd']