{"id":"GHSA-3xgr-h5hq-7299","summary":"GeoIP processor disables SSL certificate validation when downloading databases","details":"### Impact\n\nThe GeoIP processor in Data Prepper was configured to trust all SSL certificates and disable hostname verification when downloading GeoIP databases from HTTP URLs, making downloads vulnerable to man-in-the-middle attacks.\n\nThe GeoIP processor included a custom SSL implementation that completely bypassed certificate validation when downloading GeoIP databases from external sources. The `initiateSSL()` method incorrectly implemented an approach for trusting all certificates. Specifically it:\n\n* Accepted all SSL certificates without validation\n* Disabled server certificate verification\n* Disabled client certificate verification\n* Disabled hostname verification\n\nThis configuration made database downloads vulnerable to man-in-the-middle attacks, potentially allowing attackers to serve malicious GeoIP databases that could compromise the integrity of geolocation data processing.\n\n### Patches\n\nData Prepper 2.12.2 contains a fix for this issue.\n\n### Workarounds\n\nIf upgrading is not immediately possible:\n\n* Use local GeoIP database files instead of downloading from HTTP URLs\n* Ensure database downloads occur only over trusted networks","modified":"2025-10-16T08:10:43.220454Z","published":"2025-10-15T20:40:10Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2025-10-15T20:40:10Z","nvd_published_at":null,"cwe_ids":["CWE-295"],"severity":"MODERATE"},"references":[{"type":"WEB","url":"https://github.com/opensearch-project/data-prepper/security/advisories/GHSA-3xgr-h5hq-7299"},{"type":"WEB","url":"https://github.com/opensearch-project/data-prepper/commit/b82ea0640d98d9f4c742622325faeeb6248ee135"},{"type":"PACKAGE","url":"https://github.com/opensearch-project/data-prepper"}],"affected":[{"package":{"name":"org.opensearch.dataprepper.plugins:geoip-processor","ecosystem":"Maven","purl":"pkg:maven/org.opensearch.dataprepper.plugins/geoip-processor"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"fixed":"2.12.2"}]}],"versions":["2.12.0","2.12.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-3xgr-h5hq-7299/GHSA-3xgr-h5hq-7299.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}