Date: Fri, 1 Jun 2018 10:16:50 -0700 From: Denis Magda <dmagda@...che.org> To: announce@...che.org, dev <dev@...ite.apache.org>, user@...ite.apache.org, oss-security@...ts.openwall.com, "Rai, Harendra" <harendra.rai@....com> Subject: [CVE-2014-0114]: Apache Ignite is vulnerable to existing CVE-2014-0114 [CVE-2014-0114]: Apache Ignite is vulnerable to existing CVE-2014-0114 Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Ignite 2.4 or earlier Impact: An attacker can execute arbitrary code on Ignite nodes in the case when Ignite classpath contains arbitrary vulnerable classes. Description: Apache Ignite used commons-beanutils-1.8.3.jar library which did not suppress the class property, which allowed remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1. Mitigation: • All Ignite versions: make sure there are no vulnerable classes among your custom code used in Apache Ignite. • Upgrade to Apache Ignite 2.5 or later version Credit: Harendra Rai of NCR Corporation discovered the impact of the existing vulnerability on Apache Ignite. References: * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0114
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ