CVE-2020-13955 json
Missing Authentication for Critical Function in Apache Calcite
published 2020-10-09 6 y ago modified 2026-06-17 4 mo ago also GHSA-hxp5-8pgq-mgv9 , EUVD-2021-0835
- cvss
- 5.9
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.1%
- EPSS 2.1% chance of exploitation in 30 days, percentile 82%
- public exploits
- 0
- none known
Summary
HttpUtils#getURLConnection method disables explicitly hostname verification for HTTPS connections making clients vulnerable to man-in-the-middle attacks. Calcite uses internally this method to connect with Druid and Splunk so information leakage may happen when using the respective Calcite adapters. The method itself is in a utility class so people may use it to create vulnerable HTTPS connections for other applications. From Apache Calcite 1.26 onwards, the hostname verification will be performed using the default JVM truststore.
Patch / fix
- maven org.apache.calcite:calcite-core 1.26.0
- maven org.apache.calcite:calcite-druid 1.26.0
- maven org.apache.calcite:calcite-splunk 1.26.0
- apache calcite 1.26
Exploit prediction
2.15% chance of exploitation in the next 30 days, higher than 82% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N |
| GitHub | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.calcite:calcite-core | <1.26.0 |
1.26.0 |
| maven | org.apache.calcite:calcite-druid | <1.26.0 |
1.26.0 |
| maven | org.apache.calcite:calcite-splunk | <1.26.0 |
1.26.0 |
Affected products
- n/a Apache Calcite
Classification
- Weakness
-
- CWE-295 Improper Certificate Validation
References
-
github.com
/apache/calcite/commit/43eeafcbac29d02c72bd520c003cdfc571de2d15
web
-
lists.apache.org
/thread.html/r0b0fbe2038388175951ce1028182d980f9e9a7328be13d52dab70bb3%40%3Cdev.calcite.apache.org%3E
web, mailing-list, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2020-13955
advisory
-
issues.apache.org
/jira/browse/CALCITE-4298
web
Sources
- CVE List CVE-2020-13955
- GitHub Advisory GHSA-hxp5-8pgq-mgv9
- NVD CVE-2020-13955
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.