Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <5e87e214-ee78-d691-15a3-f60988c64e65@apache.org>
Date: Tue, 16 Jul 2024 19:02:32 +0000
From: Dominik Riemer <riemer@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2024-31979: Apache StreamPipes: Possibility of SSRF in
 pipeline element installation process 

Severity: moderate

Affected versions:

- Apache StreamPipes through 0.93.0

Description:

Server-Side Request Forgery (SSRF) vulnerability in Apache StreamPipes during installation process of pipeline elements.
Previously, StreamPipes allowed users to configure custom endpoints from which to install additional pipeline elements. 
These endpoints were not properly validated, allowing an attacker to get StreamPipes to send an HTTP GET request to an arbitrary address.
This issue affects Apache StreamPipes: through 0.93.0.

Users are recommended to upgrade to version 0.95.0, which fixes the issue.

Credit:

L0ne1y (finder)

References:

https://streampipes.apache.org
https://www.cve.org/CVERecord?id=CVE-2024-31979

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.