[<prev] [next>] [day] [month] [year] [list]
Message-ID: <a7c8e31b-48aa-4e45-a901-b02e5ab8d495@apache.org>
Date: Tue, 21 Jan 2025 20:33:27 +0000
From: Viraj Jasani <vjasani@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-23196: Apache Ambari: Code Injection Vulnerability in
Ambari Alert Definition
Severity: important
Affected versions:
- Apache Ambari 8 before 2.7.9
Description:
A code injection vulnerability exists in the Ambari Alert Definition
feature, allowing authenticated users to inject and execute arbitrary
shell commands. The vulnerability arises when defining alert scripts,
where the script filename field is executed using `sh -c`. An attacker
with authenticated access can exploit this vulnerability to inject
malicious commands, leading to remote code execution on the server. The
issue has been fixed in the latest versions of Ambari.
Credit:
Liyw979 (reporter)
robinzeng2015 (reporter)
fcgboy (reporter)
wk2025 (reporter)
References:
https://ambari.apache.org/
https://www.cve.org/CVERecord?id=CVE-2025-23196
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
