CVE-2020-13955

HttpUtils#getURLConnection method disables explicitly hostname verification for HTTPS connections making clients vulnerable to man-in-the-middle attacks. Calcite uses internally this method to connect with Druid and Splunk so information leakage may happen when using the respective Calcite adapters. The method itself is in a utility class so people may use it to create vulnerable HTTPS connections for other applications. From Apache Calcite 1.26 onwards, the hostname verification will be performed using the default JVM truststore.

• CWE-295

• https://lists.apache.org/thread.html/r0b0fbe2038388175951ce1028182d980f9e9a7328be13d52dab70bb3%40%3Cdev.calcite.apache.org%3EMailing List, Third Party Advisory
• https://lists.apache.org/thread.html/r0b0fbe2038388175951ce1028182d980f9e9a7328be13d52dab70bb3%40%3Cdev.calcite.apache.org%3EMailing List, Third Party Advisory

Published

Oct 9, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-1395An elevation of privilege vulnerability exists in the way th…7.8
• CVE-2020-13950Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http …7.5
• CVE-2020-13951Attackers can use public NetTest web service of Apache OpenM…7.5
• CVE-2020-13952In the course of work on the open source project it was disc…8.1
• CVE-2020-13953In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific UR…5.3
• CVE-2020-13954By default, Apache CXF creates a /services page containing a…6.1
• CVE-2020-13956Apache HttpClient versions prior to version 4.5.13 and 5.0.3…5.3
• CVE-2020-13957Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.…9.8
• CVE-2020-13958A vulnerability in Apache OpenOffice scripting events allows…7.8
• CVE-2020-13959The default error page for VelocityView in Apache Velocity T…6.1
• CVE-2020-1396An elevation of privilege vulnerability exists when Windows …7.8
• CVE-2020-13960D-Link DSL 2730-U IN_1.10 and IN_1.11 and DIR-600M 3.04 devi…7.5