Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 1 Nov 2017 11:56:06 -0700
From: Bill Farner <>
Subject: [CVE-2016-4437] Apache Aurora information disclosure vulnerability

Versions Affected:
Aurora 0.10.0 to 0.18.0

The affected versions of the scheduler rely on a version of Apache Shiro
which is vulnerable to CVE-2016-4437.  Under certain conditions, the
vulnerability allows remote attackers to execute arbitrary code or bypass
intended access restrictions via an unspecified request parameter.

0.18.0 users should upgrade to 0.18.1
0.10.0 - 0.17.0 users should upgrade to 0.18.1 or apply this patch;a=commit;h=ec640117
Alternatively, INI configuration mitigations outlined in CVE-2016-4437
may be applied.

This issue was discovered by Greg Harris from the Fitbit Security team.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.