oss-security - [CVE-2019-0202] Apache Storm Logviewer file system access vulnerability

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAG09ER2cYOo+cN+BVotmxugxaMq_ogswvuQ+Z+8W2LahK-DyPg@mail.gmail.com>
Date: Wed, 24 Jul 2019 09:26:18 +0200
From: Stig Rohde Døssing <srdo@...che.org>
To: oss-security@...ts.openwall.com
Subject: [CVE-2019-0202] Apache Storm Logviewer file system access vulnerability

[CVEID]:CVE-2019-0202[PRODUCT]:Apache Storm[VERSION]:Apache Storm
0.9.1-incubating to 1.2.2[PROBLEMTYPE]:CWE-200: Information
Exposure[DESCRIPTION]:The Apache Storm Logviewer daemon exposes
HTTP-accessible endpoints to read/search log files on hosts running
Storm.
              In Apache Storm versions 0.9.1-incubating to 1.2.2, it
is possible to read files off the
              host's file system that were not intended to be
accessible via these endpoints.

Mitigation: Upgrade to Apache Storm 1.2.3 or later.

Credit: Stig Rohde Døssing for discovery and fix

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.