oss-security - CVE update (CVE-2016-2174)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <AB91E013-C484-4EDD-98BB-0D6E4938C22A@apache.org>
Date: Wed, 1 Jun 2016 10:41:46 -0400
From: Velmurugan Periasamy <vel@...che.org>
To: security@...che.org,
 oss-security@...ts.openwall.com,
 bugtraq@...urityfocus.com
Cc: dev@...ger.incubator.apache.org,
 user@...ger.incubator.apache.org,
 private@...ger.incubator.apache.org,
 vel@...che.org
Subject: CVE update (CVE-2016-2174) - Fixed in Ranger 0.5.3

Hello:

Here’s a CVE update for Ranger 0.5.3 release. Please see below details. 

Release details can be found at https://cwiki.apache.org/confluence/display/RANGER/0.5.3+Release+-+Apache+Ranger

Thank you,
Velmurugan Periasamy

-----------------------------------------------------------------------------------------------
CVE-2016-2174: Apache Ranger sql injection vulnerability
-----------------------------------------------------------------------------------------------
Severity: Normal
Vendor: The Apache Software Foundation
Versions Affected: All versions of Apache Ranger from 0.5.0 (up to 0.5.3)
Users Affected: All admin users of ranger policy admin tool
Description: SQL Injection vulnerability in Audit > Access tab. When the user 
clicks an element from policyId row of the list, there is a call made underneath 
with eventTime parameter which contains the vulnerability. Admin users can 
send some arbitrary sql code to be executed along with eventTime parameter
 using /service/plugins/policies/eventTime url.
Fix details: Replaced native queries with JPA named queries
Mitigation: Users should upgrade to 0.5.3 version of Apache Ranger with the fix.
Credit: Thanks to Mateusz Olejarka from SecuRing for reporting this issue.
-----------------------------------------------------------------------------------------------

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.