Read the docs
TI-2022-26707 Aliases GHSA-q2fj-6h62-59m2

Apiman Vert.x Gateway has Transitive Hazelcast connection caching issue

Priority LOW 38Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

### Impact If you are using the **Apiman Vert.x Gateway** prior to Apiman 3.0.0.Final, a connection caching issue in Hazelcast could allow an unauthenticated, remote attacker to access and manipulate data in the cluster with another authenticated connection's identity. Hazelcast is a transitive dependency of the Apiman Vert.x Gateway. The precise risk is difficult to quantify at this juncture as plugins deployed by users may make use of Hazelcast in a different manner to the main Apiman codebase. If any of your custom Apiman plugins specify Hazelcast dependencies, you should also bump these versions. Hint: an easy way to track Apiman dependency versions is to use `apiman-parent`. If you use the Apiman Tomcat or WildFly Gateway this does not affect you. ### Patches Upgrade to **Apiman 3.0.0.Final or later**. If you are using an older version of Apiman and need to remain on that version, contact to your Apiman support provider for advice/long-term support. ### Workarounds None (other than doing your own build). ### References * https://github.com/advisories/GHSA-c5hg-mr8r-f6jp

Why it matters now

Fix Fixed io.apiman:apiman-gateway-platforms-vertx (Maven): 3.0.0.Finalio.apiman:apiman-distro-vertx (Maven): 3.0.0.Final

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—io.apiman:apiman-gateway-platforms-vertx (Maven)before 3.0.0.Final3.0.0.FinalPatch availableGHSA-q2fj-6h62-59m2
—io.apiman:apiman-distro-vertx (Maven)before 3.0.0.Final3.0.0.FinalPatch availableGHSA-q2fj-6h62-59m2
  • io.apiman:apiman-gateway-platforms-vertx (Maven) Vendor— Affected before 3.0.0.Final Fixed in 3.0.0.Final Patch available GHSA-q2fj-6h62-59m2
  • io.apiman:apiman-distro-vertx (Maven) Vendor— Affected before 3.0.0.Final Fixed in 3.0.0.Final Patch available GHSA-q2fj-6h62-59m2

Remediation

  • Fix · GHSA-q2fj-6h62-59m2 io.apiman:apiman-gateway-platforms-vertx (Maven) Fixed in 3.0.0.Final Advisory →
  • Fix · GHSA-q2fj-6h62-59m2 io.apiman:apiman-distro-vertx (Maven) Fixed in 3.0.0.Final Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-q2fj-6h62-59m2

References

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences