CVE-2020-26234: 
Java vulnerability analysis and mitigation

CVE-2020-26234 is a high-severity vulnerability affecting Opencast versions prior to 8.9 and 7.9. The vulnerability was discovered and disclosed on December 8, 2020. The issue involves disabled HTTPS hostname verification in Opencast's HTTP client, which is used for a significant portion of the application's HTTP requests (Opencast Advisory).

The vulnerability stems from the disabling of HTTPS hostname verification in the HTTP client implementation. The affected code explicitly bypassed certificate validation and hostname verification checks, which are crucial security mechanisms in HTTPS connections. This implementation was present in the HttpClientImpl class, where the code deliberately skipped SSL host name checks and certificate validations (Opencast Commit).

The disabled hostname verification could allow attackers to perform man-in-the-middle attacks. When hostname verification is disabled, the system cannot properly verify whether the presented certificate is valid for the host being connected to, potentially allowing malicious actors to intercept and manipulate HTTPS traffic (Opencast Advisory).

The vulnerability requires an attacker to be in a position to intercept HTTPS traffic between the affected Opencast installation and its communication endpoints. The vulnerability is particularly concerning in environments where the attacker could position themselves between the client and server communications (Opencast Advisory).

The vulnerability has been patched in Opencast versions 7.9 and 8.9. Users are advised to upgrade to these versions or later. For systems using self-signed certificates, administrators need to properly import them into the Java key store after applying the patch. The developers recommend obtaining valid certificates from legitimate certificate authorities like Let's Encrypt instead of using self-signed certificates (Opencast Advisory).