CVE-2023-4586: 
Apache ZooKeeper vulnerability analysis and mitigation

A vulnerability (CVE-2023-4586) was discovered in the Hot Rod client, a component of Red Hat Data Grid. The vulnerability was identified when it was found that the Hot Rod client does not enable hostname validation when using TLS connections. The issue was reported on August 29, 2023, and affects Red Hat Data Grid systems (Red Hat Advisory).

The vulnerability stems from improper certificate validation (CWE-295) and improper input validation (CWE-20) in the Hot Rod client's TLS implementation. The vulnerability has received a CVSS v3.1 base score of 7.4 (HIGH), with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, indicating that it can be exploited remotely with no privileges required (NVD).

The vulnerability could potentially allow attackers to perform man-in-the-middle (MITM) attacks due to the lack of hostname validation during TLS connections. This could lead to the compromise of confidentiality and integrity of data transmitted between the client and server (Red Hat Advisory).

Red Hat has addressed this vulnerability in Red Hat Data Grid 8.4.6, released through security advisory RHSA-2023:7676 on December 6, 2023. Users are advised to update to this version to mitigate the security risk (Red Hat Advisory).