GeoIP processor disables SSL certificate validation when downloading databases
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-295.
Summary
### Impact The GeoIP processor in Data Prepper was configured to trust all SSL certificates and disable hostname verification when downloading GeoIP databases from HTTP URLs, making downloads vulnerable to man-in-the-middle attacks. The GeoIP processor included a custom SSL implementation that completely bypassed certificate validation when downloading GeoIP databases from external sources. The `initiateSSL()` method incorrectly implemented an approach for trusting all certificates. Specifically it: * Accepted all SSL certificates without validation * Disabled server certificate verification * Disabled client certificate verification * Disabled hostname verification This configuration made database downloads vulnerable to man-in-the-middle attacks, potentially allowing attackers to serve malicious GeoIP databases that could compromise the integrity of geolocation data processing. ### Patches Data Prepper 2.12.2 contains a fix for this issue. ### Workarounds If upgrading is not immediately possible: * Use local GeoIP database files instead of downloading from HTTP URLs * Ensure database downloads occur only over trusted networks
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | org.opensearch.dataprepper.plugins:geoip-processor (Maven) | 2.7.0 to before 2.12.2 | 2.12.2 | Patch available | GHSA-3xgr-h5hq-7299 |
- org.opensearch.dataprepper.plugins:geoip-processor (Maven) Vendor— Affected 2.7.0 to before 2.12.2 Fixed in 2.12.2 Patch available GHSA-3xgr-h5hq-7299
Remediation
- Fix · GHSA-3xgr-h5hq-7299 org.opensearch.dataprepper.plugins:geoip-processor (Maven) Fixed in 2.12.2 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-3xgr-h5hq-7299
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences