[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CANh7qnQU4caCP7xQ2pGLo7b6rCrhkMPtdaw0rZgNygfK2001ag@mail.gmail.com>
Date: Wed, 5 Aug 2020 20:59:26 +0800
From: Sheng Wu <wusheng@...che.org>
To: oss-security@...ts.openwall.com
Subject: [CVE-2020-13921] Apache SkyWalking SQL injection
vulnerability after H2/MySQL/TiDB storage option activated.
[CVEID]:CVE-2020-13921
[PRODUCT]:Apache SkyWalking
[VERSION]:Apache SkyWalking 6.5.0, 6.6.0, 7.0.0, 8.0.0, 8.0.1
[PROBLEMTYPE]:SQL Injection
[REFERENCES]:https://github.com/apache/skywalking/pull/4970
[DESCRIPTION]:**Resolved** Only when using H2/MySQL/TiDB as Apache
SkyWalking storage, there is a SQL injection vulnerability in the wildcard
query cases.
[ASSIGNINGCNA]: Apache Software Foundation
Sheng Wu 吴晟
Twitter, wusheng1108
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
