Missing Authentication for Critical Function in Apache Calcite
"HttpUtils#getURLConnection method disables explicitly hostname verification for HTTPS connections making clients vulnerable to man-in-the-middle attacks. Calcite uses this method internally to connect with Druid and Splunk so information leakage may happen when using the respective Calcite adapters. The method itself is in a utility class so people may use it to create vulnerable HTTPS connections for other applications. From Apache Calcite 1.26 onwards, the hostname verification will be performed using the default JVM truststore."
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | org.apache.calcite:calcite-core | < 1.26.0 | 1.26.0 |
| Java / Kotlin (Maven) | org.apache.calcite:calcite-druid | < 1.26.0 | 1.26.0 |
| Java / Kotlin (Maven) | org.apache.calcite:calcite-splunk | < 1.26.0 | 1.26.0 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-13955
- https://github.com/apache/calcite/commit/43eeafcbac29d02c72bd520c003cdfc571de2d15
- https://issues.apache.org/jira/browse/CALCITE-4298
- https://lists.apache.org/thread.html/r0b0fbe2038388175951ce1028182d980f9e9a7328be13d52dab70bb3%40%3Cdev.calcite.apache.org%3E
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N- Weakness (CWE)
CWE-295- Platform
- Java / Kotlin (Maven)
- Package
org.apache.calcite:calcite-core, org.apache.calcite:calcite-druid, org.apache.calcite:calcite-splunk- Disclosed
- 22.04.2021
- Updated
- 11.10.2026 11:21
Sources and licenses
OSV / GitHub Advisory Database - GHSA-hxp5-8pgq-mgv9 - CC BY 4.0
Vulnerability history: org.apache.calcite:calcite-splunk
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.