[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CACR6SAXDk+Ronjh8KQ91q2W4FpiOmiJyjkUe9v4o9L8Bvkhvvw@mail.gmail.com>
Date: Tue, 24 Nov 2020 18:12:36 +0100
From: Serge Huber <shuber@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2020-13942: Remote Code Execution in Apache Unomi
Description:
It is possible to inject malicious OGNL or MVEL scripts into the
/context.json public endpoint. This was partially fixed in 1.5.1 but a
new attack vector was found. In version 1.5.2 scripts are now
completely filtered from the input. It is highly recommended to
upgrade to the latest available version of the 1.5.x release to fix
this problem.
References:
http://unomi.apache.org./security/cve-2020-13942.txt
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
