[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAEwge-GQLV_9Y56psCejkhA-B3jx4amnQP5AoVwURbzn=DCZOw@mail.gmail.com>
Date: Thu, 22 Feb 2018 13:46:43 -0800
From: Anthony Baker <abaker@...che.org>
To: user@...de.apache.org, dev@...de.apache.org,
asf-security <security@...che.org>, announce@...che.org, oss-security@...ts.openwall.com
Subject: [SECURITY] CVE-2017-15696 Apache Geode configuration request
authorization vulnerability
CVE-2017-15696 Apache Geode configuration request authorization vulnerability
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected: Apache Geode 1.0.0 through 1.3.0
Description:
The Geode configuration service does not properly authorize
configuration requests. This allows an unprivileged user who gains
access to the Geode locator to extract configuration data and
previously deployed application code.
Mitigation:
Users of the affected versions should upgrade to Apache Geode 1.4.0 or later.
Credit:
This issue was reported responsibly to the Apache Geode Security Team
by Dan Smith from Pivotal.
References:
[1] https://issues.apache.org/jira/browse/GEODE-3962
[2] https://cwiki.apache.org/confluence/display/GEODE/Release+Notes#ReleaseNotes-SecurityVulnerabilities
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
