Read the docs
TI-2025-43791 Aliases GHSA-3xgr-h5hq-7299

GeoIP processor disables SSL certificate validation when downloading databases

Priority LOW 38CWE-295Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Spoofing
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-295.

Summary

### Impact The GeoIP processor in Data Prepper was configured to trust all SSL certificates and disable hostname verification when downloading GeoIP databases from HTTP URLs, making downloads vulnerable to man-in-the-middle attacks. The GeoIP processor included a custom SSL implementation that completely bypassed certificate validation when downloading GeoIP databases from external sources. The `initiateSSL()` method incorrectly implemented an approach for trusting all certificates. Specifically it: * Accepted all SSL certificates without validation * Disabled server certificate verification * Disabled client certificate verification * Disabled hostname verification This configuration made database downloads vulnerable to man-in-the-middle attacks, potentially allowing attackers to serve malicious GeoIP databases that could compromise the integrity of geolocation data processing. ### Patches Data Prepper 2.12.2 contains a fix for this issue. ### Workarounds If upgrading is not immediately possible: * Use local GeoIP database files instead of downloading from HTTP URLs * Ensure database downloads occur only over trusted networks

Why it matters now

Fix Fixed org.opensearch.dataprepper.plugins:geoip-processor (Maven): 2.12.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—org.opensearch.dataprepper.plugins:geoip-processor (Maven)2.7.0 to before 2.12.22.12.2Patch availableGHSA-3xgr-h5hq-7299
  • org.opensearch.dataprepper.plugins:geoip-processor (Maven) Vendor— Affected 2.7.0 to before 2.12.2 Fixed in 2.12.2 Patch available GHSA-3xgr-h5hq-7299

Remediation

  • Fix · GHSA-3xgr-h5hq-7299 org.opensearch.dataprepper.plugins:geoip-processor (Maven) Fixed in 2.12.2 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-3xgr-h5hq-7299

References

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences