CVE-2021-36152: 
Java vulnerability analysis and mitigation

Apache Gobblin, versions 0.15.0 and earlier, contained a security vulnerability where it trusts all certificates used for LDAP connections in Gobblin-as-a-Service (Apache List, Openwall). The vulnerability was discovered by Simon Gerst and was assigned CVE-2021-36152, with disclosure occurring in February 2022.

The vulnerability stems from an insecure TrustManager implementation in LDAP connections within Gobblin-as-a-Service. The issue results in the system accepting all certificates without proper validation, which could potentially compromise the security of LDAP connections (NVD).

The vulnerability's impact is primarily related to the security of LDAP connections in Gobblin-as-a-Service environments. By trusting all certificates without proper validation, the system becomes susceptible to potential man-in-the-middle attacks and unauthorized access through compromised certificates (Apache List).

Users are advised to update to Apache Gobblin version 0.16.0, which addresses this security issue. This version implements proper certificate validation for LDAP connections (Openwall).