TI-2020-10931 Aliases CVE-2020-13955 GHSA-hxp5-8pgq-mgv9

Improper certificate validation in Apache Calcite

LOW 31CWE-295Published 2020-10-09 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Spoofing
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-295.

Summary

HttpUtils#getURLConnection method disables explicitly hostname verification for HTTPS connections making clients vulnerable to man-in-the-middle attacks. Calcite uses internally this method to connect with Druid and Splunk so information leakage may happen when using the respective Calcite adapters. The method itself is in a utility class so people may use it to create vulnerable HTTPS connections for other applications. From Apache Calcite 1.26 onwards, the hostname verification will be performed using the default JVM truststore.

Why it matters now

EPSS 0.02149 82nd percentileScored 2026-11-08

Fix Fixed org.apache.calcite:calcite-core (Maven): 1.26.0org.apache.calcite:calcite-druid (Maven): 1.26.0+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	Apache Calcite	Apache Calcite 0.8 to 1.25	—	No fix listed	CNA
—	org.apache.calcite:calcite-core (Maven)	before 1.26.0	1.26.0	Patch available	GHSA-hxp5-8pgq-mgv9
—	org.apache.calcite:calcite-druid (Maven)	before 1.26.0	1.26.0	Patch available	GHSA-hxp5-8pgq-mgv9
—	org.apache.calcite:calcite-splunk (Maven)	before 1.26.0	1.26.0	Patch available	GHSA-hxp5-8pgq-mgv9

Apache Calcite Vendor— Affected Apache Calcite 0.8 to 1.25 Fixed in — No fix listed CNA
org.apache.calcite:calcite-core (Maven) Vendor— Affected before 1.26.0 Fixed in 1.26.0 Patch available GHSA-hxp5-8pgq-mgv9
org.apache.calcite:calcite-druid (Maven) Vendor— Affected before 1.26.0 Fixed in 1.26.0 Patch available GHSA-hxp5-8pgq-mgv9
org.apache.calcite:calcite-splunk (Maven) Vendor— Affected before 1.26.0 Fixed in 1.26.0 Patch available GHSA-hxp5-8pgq-mgv9

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:calcite::::::::	before 1.26	Vulnerable	Apache

cpe:2.3:a:apache:calcite:*:*:*:*:*:*:*:* Versions before 1.26 Vulnerable ·Apache

Remediation

Fix · GHSA-hxp5-8pgq-mgv9 org.apache.calcite:calcite-core (Maven) Fixed in 1.26.0 Advisory →
Fix · GHSA-hxp5-8pgq-mgv9 org.apache.calcite:calcite-druid (Maven) Fixed in 1.26.0 Advisory →
Fix · GHSA-hxp5-8pgq-mgv9 org.apache.calcite:calcite-splunk (Maven) Fixed in 1.26.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2020-13955
2026-10-03 Alias added: GHSA-hxp5-8pgq-mgv9

References

Advisory 2

Other 2

TI-2022-18523 Apache Calcite: potential XEE attacks CVSS 3.1CRITICAL 9.8
TI-2026-34343 Apache Calcite: A user-controled model can load arbitrary classes, leading to code execution CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences