---
title: "Beam Security"
aliases: /security/CVE-2020-1929/
---
<!--
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->

# Reporting Security Issues

Apache Beam uses the standard process outlined by the [Apache Security
Team](https://www.apache.org/security/) for reporting vulnerabilities. Note
that vulnerabilities should not be publicly disclosed until the project has
responded.

To report a possible security vulnerability, please email
`security@apache.org` and `pmc@beam.apache.org`. This is a non-public list
that will reach the Beam PMC.

# Known Security Issues

## CVE-2020-1929

[CVE-2020-1929] Apache Beam MongoDB IO connector disables certificate trust verification

Severity: Major  
Vendor: The Apache Software Foundation   

Versions Affected:  
Apache Beam 2.10.0 to 2.16.0

Description:  
The Apache Beam MongoDB connector in versions 2.10.0 to 2.16.0 has an option to
disable SSL trust verification. However this configuration is not respected and
the certificate verification disables trust verification in every case. This
exclusion also gets registered globally which disables trust checking for any
code running in the same JVM.

Mitigation:  
Users of the affected versions should apply one of the following mitigations:
- Upgrade to Apache Beam 2.17.0 or later

Acknowledgements:  
This issue was reported (and fixed) by Colm Ó hÉigeartaigh.
