[<prev] [next>] [day] [month] [year] [list]
Message-ID: <c1198a43-4faf-304e-2c4c-feb1494caacb@apache.org>
Date: Wed, 24 Jul 2024 04:13:49 +0000
From: James Turton <dzamo@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2023-48362: Apache Drill: XXE Vulnerability in XML Format
Reader
Severity: moderate
Affected versions:
- Apache Drill 1.19.0 before 1.21.2
Description:
XXE in the XML Format Plugin in Apache Drill version 1.19.0 and greater allows a user to read any file on a remote file system or execute commands via a malicious XML file.
Users are recommended to upgrade to version 1.21.2, which fixes this issue.
This issue is being tracked as DRILL-8461
Credit:
Yuzhe Huang (finder)
References:
https://drill.apache.org/
https://www.cve.org/CVERecord?id=CVE-2023-48362
https://issues.apache.org/jira/browse/DRILL-8461
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
