Spring Boot versions 2.7.0 to 4.0.5 contain a vulnerability (CWE-295) in the Cassandra SSL auto-configuration component where hostname verification is not enforced when establishing SSL connections. This improper certificate validation undermines the security guarantees of SSL/TLS by allowing connections to Cassandra servers without verifying that the server's hostname matches the certificate. Affected versions include 2.7.0–2.7.32, 3.3.0–3.3.18, 3.4.0–3.4.15, 3.5.0–3.5.13, and 4.0.0–4.0.5. Fixed versions are 2.7.33, 3.3.19, 3.4.16, 3.5.14, and 4.0.6 respectively. The CVSS 3.1 base score is 5.0 (medium), reflecting the attack vector as adjacent network with high attack complexity and no privileges required.

The vulnerability allows an attacker with access to the network path between the Spring Boot application and the Cassandra server to potentially perform man-in-the-middle attacks due to missing hostname verification in SSL connections. This can lead to partial confidentiality, integrity, and availability impacts as indicated by the CVSS vector (C:L/I:L/A:L). There are no known exploits in the wild currently.

Fixed versions of Spring Boot have been released that address this vulnerability by adding proper hostname verification in Cassandra SSL auto-configuration. Users should upgrade to the fixed versions: 2.7.33, 3.3.19, 3.4.16, 3.5.14, or 4.0.6 depending on their current version. Patch status is not explicitly confirmed in the provided data, but the vendor advisory indicates fixes in these versions. No other mitigation guidance is provided. Check the official Spring Boot release notes and advisories for the latest remediation instructions.