[<prev] [next>] [day] [month] [year] [list]
Message-ID: <25b8101c-0813-a0e1-91a3-a3bfe9281e35@apache.org>
Date: Mon, 16 Oct 2023 02:00:08 +0000
From: Wang Weibing <wwbmmm@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2023-45757: Apache bRPC: The builtin service rpcz page has an
XSS attack vulnerability
Severity: important
Affected versions:
- Apache bRPC 0.9.0 through 1.6.0
Description:
Security vulnerability in Apache bRPC <=1.6.0 on all platforms allows attackers to inject XSS code to the builtin rpcz page.
An attacker that can send http request to bRPC server with rpcz enabled can inject arbitrary XSS code to the builtin rpcz page.
Solution (choose one of three):
1. upgrade to bRPC > 1.6.0, download link: https://dist.apache.org/repos/dist/release/brpc/1.6.1/
2. If you are using an old version of bRPC and hard to upgrade, you can apply this patch: https://github.com/apache/brpc/pull/2411
3. disable rpcz feature
References:
https://brpc.apache.org
https://www.cve.org/CVERecord?id=CVE-2023-45757
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
