oss-security - [CVE-2020-1952] Apache IoTDB (incubating) Remote Code execution vulnerability

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <495649d.8617.171b9681ae6.Coremail.liudw@apache.org>
Date: Mon, 27 Apr 2020 10:12:19 +0800 (GMT+08:00)
From: "Dawei Liu" <liudw@...che.org>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: [CVE-2020-1952] Apache IoTDB (incubating)   Remote Code execution
 vulnerability

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected:
IoTDB  0.9.0 to 0.9.1
IoTDB 0.8.0 to 0.8.2

Description:
When starting IoTDB, the JMX port 31999 is exposed with no certification.
Then, clients could execute code remotely. 

Mitigation: 0.8.x, 0.9.0, and 0.9.1 users should upgrade to 0.9.2.

Example: An Attacker can execute code remotely in the IoTDB server through JMX port.

Credit:  This issue was discovered by WuXiong of QI’ANXIN YunYing Lab.

Regards,
The Apache IoTDB team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.