oss-security - CVE update - fixed in Apache Ranger 0.6.3

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <630EBE51-95AF-46C9-B51F-AA3D1D584A10@apache.org>
Date: Wed, 1 Feb 2017 14:08:50 -0500
From: Velmurugan Periasamy <vel@...che.org>
To: security <security@...che.org>,
 oss-security@...ts.openwall.com,
 bugtraq@...urityfocus.com
Cc: private@...ger.apache.org,
 dev@...ger.apache.org,
 user@...ger.apache.org
Subject: CVE update - fixed in Apache Ranger 0.6.3

Hello:

Please find below details on CVEs fixed in Ranger 0.6.3 release. Release details can be found at https://cwiki.apache.org/confluence/display/RANGER/0.6.3+Release+-+Apache+Ranger <https://cwiki.apache.org/confluence/display/RANGER/0.6.3+Release+-+Apache+Ranger>

Thank you,
Velmurugan Periasamy

-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
CVE-2016-8746: Apache Ranger path matching issue in policy evaluation
Severity: Normal
Vendor: The Apache Software Foundation
Versions Affected: 0.6.0/0.6.1/0.6.2 versions of Apache Ranger
Users affected: All users of ranger policy admin tool
Description: Ranger policy engine incorrectly matches paths in certain conditions when policy does not contain wildcards and has recursion flag set to true.
Fix detail: Fixed policy evaluation logic.
Mitigation: Users should upgrade to 0.6.3 or later version of Apache Ranger with the fix.
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
CVE-2016-8751: Apache Ranger stored cross site scripting issue
Severity: Normal
Vendor: The Apache Software Foundation
Versions Affected: 0.5.x and 0.6.0/0.6.1/0.6.2 versions of Apache Ranger
Users affected: All users of ranger policy admin tool
Description: Apache Ranger was found to be vulnerable to a Stored Cross-Site Scripting in when entering custom policy conditions. Admin users can store 
some arbitrary javascript code to be executed when normal users login and access policies.
Fix detail: Added logic to sanitize the user input.
Mitigation: Users should upgrade to 0.6.3 or later version of Apache Ranger with the fix.
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.