[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAFBzuDOyYgqTHj5vq-w2jjrk9Gh-q4kB56cdxZ_KG3Pd80bEPQ@mail.gmail.com>
Date: Tue, 23 Apr 2019 08:29:28 +0100
From: Apache Security Team <security@...che.org>
To: oss-security@...ts.openwall.com
Subject: Issues fixed in previous releases of Apache Zeppelin 0.7.3 and 0.8.0
(CVE-2017-12619 CVE-2018-1317 CVE-2018-1328)
The following three issues were fixed in previous releases of Apache
Zeppelin but had not been disclosed. This email is being sent by the
ASF Security Team on behalf of Apache Zeppelin.
[CVEID]:CVE-2017-12619
[PRODUCT]:Apache Zeppelin
[VERSION]:Apache Zeppelin prior to 0.7.3 (released September 2017)
[PROBLEMTYPE]:Session Fixation
[REFERENCES]:https://zeppelin.apache.org/releases/zeppelin-release-0.7.3.html
[DESCRIPTION]: Apache Zeppelin prior to 0.7.3 was vulnerable to
session fixation which allowed an attacker to hijack a valid user
session. Issue was reported by "stone lone".
[CVEID]:CVE-2018-1317
[PRODUCT]:Apache Zeppelin
[VERSION]:Apache Zeppelin prior to 0.8.0 (released July 2018)
[PROBLEMTYPE]:Improper Authentication
[REFERENCES]:https://zeppelin.apache.org/releases/zeppelin-release-0.8.0.html
[DESCRIPTION]: In Apache Zeppelin prior to 0.8.0 the cron scheduler
was enabled by default and could allow users to run paragraphs as
other users without authentication.
[CVEID]:CVE-2018-1328
[PRODUCT]:Apache Zeppelin
[VERSION]:Apache Zeppelin prior to 0.8.0 (released July 2018)
[PROBLEMTYPE]:Stored XSS
[REFERENCES]:https://zeppelin.apache.org/releases/zeppelin-release-0.8.0.html
[DESCRIPTION]: Apache Zeppelin prior to 0.8.0 had a stored XSS issue
via Note permissions. Issue reported by "Josna Joseph"
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
