[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAEwge-Ei_WkFg5Jkq2H2adyDwt=DGuhY-Uc=0mM9DmhQvYcK4g@mail.gmail.com>
Date: Thu, 20 Jun 2019 07:22:18 -0700
From: Anthony Baker <abaker@...che.org>
To: user@...de.apache.org, geode <dev@...de.apache.org>,
asf-security <security@...che.org>, oss-security@...ts.openwall.com, announce@...che.org
Subject: [CVE-2017-15694] Apache Geode metadata modification vulnerability
CVE-2017-15694 Apache Geode metadata modification vulnerability
Severity: Medium
Vendor: The Apache Software Foundation
Versions Affected:
Apache Geode 1.0.0 through 1.8.0
Description:
When a Geode server is operating in secure mode, a user with write
permissions for specific data regions can modify internal cluster
metadata. A malicious user could modify this data in a way that affects
the operation of the cluster.
Mitigation:
Users of the affected versions should upgrade to Apache Geode 1.9.0 or
later.
Credit:
This issue was reported responsibly to the Apache Geode Security Team by
Jason Huynh from Pivotal.
References:
[1] https://issues.apache.org/jira/browse/GEODE-3981
[2]
https://cwiki.apache.org/confluence/display/GEODE/Release+Notes#ReleaseNotes-SecurityVulnerabilities
---
The Geode PMC
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
