[<prev] [next>] [day] [month] [year] [list]
Message-Id: <EBCD031F-3A4D-4A3F-9E3E-ACC7A6C6A624@gridgain.com>
Date: Wed, 26 Sep 2018 22:56:04 +0300
From: Alexander Gerus <agerus@...dgain.com>
To: oss-security@...ts.openwall.com
Subject: Apache Ignite: CVE-2018-8018, CVE-2018-1273, CVE-2018-1274:
Notification on available mitigation
[CVE-2018-8018] Possible Execution of Arbitrary Code via Apache Ignite GridClientJdkMarshaller
Severity: Important
Vendor: GridGain Systems
Versions Affected:
GridGain Professional Edition 2.4.7 or earlier
GridGain Ultimate and Enterprise Editions 8.4.7 or earlier
Impact:
An attacker can execute arbitrary code on Ignite nodes via GridClientJdkMarshaller deserialization endpoint in the case when Ignite classpath contains arbitrary vulnerable classes.
Description:
Apache Ignite serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be exploited if the one sends a specially prepared form of a serialized object to GridClientJdkMarshaller deserialization endpoint.
Mitigation:
All GridGain versions: make sure there are no vulnerable classes among your custom code used in GridGain.
Ignite Professional Edition 2.4.7 or earlier users: upgrade to Ignite 2.4.8 or later version
Ignite Ultimate and Enterprise Editions 8.4.7 or earlier users: upgrade to Ignite 8.4.8 or later version
After version upgrade use IGNITE_MARSHALLER_WHITELIST and/or IGNITE_MARSHALLER_BLACKLIST system properties to define classes allowed for deserialization. Refer to documentation for more details:
https://apacheignite.readme.io/docs/securing-data-deserialization <https://apacheignite.readme.io/docs/securing-data-deserialization>
Credit:
The vulnerability was discovered by Man Yue Mo of lgtm.com
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8018 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8018>
[CVE-2018-1273] [CVE-2018-1274] Apache Ignite impacted by security vulnerability in Spring Data Commons
Severity: Important
Vendor: GridGain Systems
Versions Affected:
GridGain Professional Edition 2.4.7 or earlier
GridGain Ultimate and Enterprise Editions 8.4.7 or earlier
Impact:
An unauthenticated remote malicious user (or attacker) can issue requests against Spring Data REST or Spring Data
Description:
Apache Ignite utilizes Spring Data Common library for some of its components. The vulnerability affects Apache Ignite users who us Spring Data REST for access an Ignite cluster via HTTP and Spring Data. Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against
Spring Data REST backed HTTP resources or using Spring Data’s projection-based request payload binding hat can lead to a remote code execution attack.
Mitigation:
Ignite Professional Edition 2.4.7 or earlier users: upgrade to Ignite 2.4.8 or later version
Ignite Ultimate and Enterprise Editions 8.4.7 or earlier users: upgrade to Ignite 8.4.8 or later version
Credit:
Harendra Rai of NCR Corporation discovered the impact of the existing vulnerability on Apache Ignite.
Reference:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1273 <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1273>
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1274 <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1274>
--
Alexander Gerus, On behalf of GridGain team.
E agerus@...dgain.com
gridgain.com
Powered by Apache® Ignite™
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
