oss-security - CVE-2024-45505: Apache HertzBeat (incubating): Exists Native Deser RCE and file writing vulnerabilities

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <243e28be-4eb7-7986-e810-b5a041f40ba2@apache.org>
Date: Sat, 16 Nov 2024 09:42:48 +0000
From: Chao Gong <gongchao@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2024-45505: Apache HertzBeat (incubating): Exists Native Deser
 RCE and file writing vulnerabilities 

Severity: moderate

Affected versions:

- Apache HertzBeat (incubating) before 1.6.1

Description:

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache HertzBeat (incubating).

This vulnerability can only be exploited by authorized attackers.
This issue affects Apache HertzBeat (incubating): before 1.6.1.

Users are recommended to upgrade to version 1.6.1, which fixes the issue.

Credit:

Unam4 (finder)
Springkilll (finder)
yemoli (finder)
yulate (finder)

References:

https://www.cve.org/CVERecord?id=CVE-2024-45505

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.