GHSA-28gg-8qqj-fhh5: 
Java vulnerability analysis and mitigation

OpenSearch Data Prepper versions 2.4.0 through 2.12.2 contained a vulnerability related to the use of deprecated SSL protocol identifiers. The issue was discovered and disclosed on October 15, 2025, affecting multiple components including the GeoIP processor and Kafka source and buffer plugins. The vulnerability received a CVSS score of 4.8 (Moderate severity) and was assigned the identifier GHSA-28gg-8qqj-fhh5 (GitHub Advisory).

The vulnerability stems from the use of SSLContext.getInstance("SSL") in multiple Data Prepper plugins, which could potentially allow the use of deprecated SSL protocols (SSLv2, SSLv3) that have known security vulnerabilities. While modern Java implementations typically default to secure TLS versions even with the "SSL" identifier, the use of this deprecated protocol identifier could potentially allow connections to negotiate weaker SSL protocols instead of enforcing modern TLS versions. The vulnerability has a CVSS vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, indicating network attack vector with high complexity, no privileges required, and potential impact on confidentiality and integrity (GitHub Advisory).

The vulnerability affects the security of data transmission in two main components: the GeoIP Processor's DBSource.initiateSSL() method used for downloading GeoIP databases from external sources, and the Kafka Plugin's CustomClientSslEngineFactory and InsecureSslEngineFactory classes used for Kafka client connections. This could potentially allow connections to negotiate weaker SSL protocols instead of enforcing modern TLS versions, reducing the security of data transmission (GitHub Advisory).

The vulnerability has been patched in Data Prepper version 2.12.2. For users unable to upgrade immediately, several workarounds are available: ensure the Java runtime is configured to disable deprecated SSL protocols, use network-level controls to enforce TLS-only connections, and use external tools to verify that deprecated SSL protocols are not allowed. The fix involves replacing all instances of SSLContext.getInstance("SSL") with SSLContext.getInstance("TLS") (GitHub Advisory).