description: When TLS is enabled with ssl-endpoint-identification-enabled set to true, Apache Geode fails to perform hostname verification of the entries in the certificate SAN during the SSL handshake. This could compromise intra-cluster communication using a man-in-the-middle attack.
problem types: Improper Certificate Validation
affected:
{
product: Apache Geode
vendor: n/a
versions:
status: affected, version: Apache Tomcat 1.9.0
}