Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.opensearch.dataprepper.plugins:opensearch

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.4MavenPublished

    OpenSearch Data Prepper plugins trust all SSL certificates by default

    CVE-2025-62371 · GHSA-43ff-rr26-8hx4

    Affected
    • Maven org.opensearch.dataprepper.plugins:opensearch < 2.12.2
    Fixed in
    2.12.2· Vendor fix available
    Issue
    Impact The OpenSearch sink and source plugins in Data Prepper are configured to trust all SSL certificates by default when no certificate path was provided, making connections vulnerable to man-in-the-middle attacks. Prior to this fix, the OpenSearch sink and source plugins would automatically use a trust all SSL strategy when connecting to OpenSearch clusters if no certificate path was explicitly configured. This behavior bypassed SSL certificate validation, potentially allowing attackers to intercept and modify data in transit through man-in-the-middle attacks. The vulnerability affects connections to OpenSearch when the cert parameter is not explicitly provided. Patches Data Prepper 2.12.2 Workarounds If you cannot immediately upgrade to the fixed version, you can implement the following workaround. OpenSearch sink Add the cert parameter to your OpenSearch sink configuration with the path to your cluster's CA certificate. The following example shows how to accomplish this.…

    Recommended action: Upgrade to 2.12.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →