Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 15 Feb 2018 14:09:50 -0800
From: Rohini Palaniswamy <>
Subject: [CVE-2017-15712] Apache Oozie Server vulnerability

Apache Oozie is a workflow scheduler system to manage Apache Hadoop jobs.

Severity: Severe

The Apache Software Foundation

Versions Affected:
Oozie 3.1.3-incubating to Oozie 4.3.0
Oozie 5.0.0-beta1

Vulnerability allows a user of Oozie to expose private files on the Oozie
server process.  The malicious user can construct a workflow XML file
containing XML directives and configuration that reference sensitive files
on the Oozie server host.

Users should upgrade to Apache Oozie 4.3.1 release from .
Users should use 5.0.0-beta1 release only for testing purposes and wait for
the 5.0.0 GA which will have the fix.

The issues were discovered by Daryn Sharp and Jason Lowe of Oath (formerly
Yahoo! Inc).

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.