[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAHydKRCdXAepr6pjqqXUSWhSnnRrrYKnNSQVjsX6V2JTvM1xNA@mail.gmail.com>
Date: Wed, 19 Dec 2018 19:46:03 +0100
From: Gézapeti Cseh <gezapeti@...che.org>
To: user@...ie.apache.org
Cc: dev@...ie.apache.org, private@...ie.apache.org,
oss-security@...ts.openwall.com, satishsaley@...che.org
Subject: [CVE-2018-11799] Apache Oozie security vulnerability
CVE-2018-11799: Apache Oozie security vulnerability
Severity: 8.7 (High) (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N)
Vendor: The Apache Software Foundation
Versions Affected: Oozie versions earlier than 5.1.0
Description: A malicious user can construct an XML that results workflows
running in other user's name.
Mitigation: Upgrade to Apache Oozie 5.1.0
Credit: This issue was discovered by
*Satish Subhashrao Saley at Oath / Yahoo!*
Gezapeti Cseh
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
