https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 21 Oct 2026 06:34:46 +0000 https://db.gcve.eu/vuln/ghsa-x5hg-x4gv-j98m <p><strong>Affected:</strong> Maven: org.opensearch.plugin:opensearch-security</p> <p>### Description</p> <p>A regression was introduced in OpenSearch 2.18.0 that caused the `plugins.security.ssl.transport.enforce_hostname_verification` setting to be ineffective. When this setting was enabled, OpenSearch did not verify that the hostname in a connecting node&#39;s TLS certificate matched the hostname of the connection. This could allow a node with a valid certificate (signed by the cluster&#39;s trusted CA) but an incorrect hostname SAN to join the cluster.</p> <p>### Impact</p> <p>Clusters running affected versions with hostname verification enabled did not receive the expected protection from this setting. A node presenting a certificate signed by the cluster&#39;s trusted CA could join the cluster regardless of whether its hostname SAN matched. This regression does not affect certificate validation itself — only the additional hostname verification check.</p> <p>### Patches</p> <p>This issue is fixed in OpenSearch 2.19.4 and 3.3.0.</p> <p>### Workarounds</p> <p>Use more restrictive values for `plugins.security.nodes_dn` to limit which certificates are accepted for node-to-node communication.</p> <p><strong>Affected:</strong> Maven: org.opensearch.plugin:opensearch-security</p> <p>### Description</p> <p>A regression was introduced in OpenSearch 2.18.0 that caused the `plugins.security.ssl.transport.enforce_hostname_verification` setting to be ineffective. When this setting was enabled, OpenSearch did not verify that the hostname in a connecting node&#39;s TLS certificate matched the hostname of the connection. This could allow a node with a valid certificate (signed by the cluster&#39;s trusted CA) but an incorrect hostname SAN to join the cluster.</p> <p>### Impact</p> <p>Clusters running affected versions with hostname verification enabled did not receive the expected protection from this setting. A node presenting a certificate signed by the cluster&#39;s trusted CA could join the cluster regardless of whether its hostname SAN matched. This regression does not affect certificate validation itself — only the additional hostname verification check.</p> <p>### Patches</p> <p>This issue is fixed in OpenSearch 2.19.4 and 3.3.0.</p> <p>### Workarounds</p> <p>Use more restrictive values for `plugins.security.nodes_dn` to limit which certificates are accepted for node-to-node communication.</p> https://db.gcve.eu/vuln/ghsa-x5hg-x4gv-j98m