Date: Mon, 30 Mar 2015 16:11:33 -0400 From: Dave <snoopdave@...il.com> To: security@...che.org, oss-security@...ts.openwall.com, bugtraq@...urityfocus.com Subject: Fwd: CVE-2015-0249: Apache Roller allows admin users to execute arbitrary Java code ---------- Forwarded message ---------- From: Dave <snoopdave@...il.com> Date: Tue, Mar 24, 2015 at 7:22 PM Subject: CVE-2015-0249: Apache Roller allows admin users to execute arbitrary Java code To: "dev@...ler.apache.org" <dev@...ler.apache.org>, user@...ler.apache.org Severity: Important Vendor: The Apache Software Foundation Versions Affected: Roller 5.1.1 Roller 5.1 The unsupported pre-Roller 5.1 versions may also be affected Description: A Roller user with Admin-level access to a weblog can edit a weblog page template and use special Velocity syntax to execute Java code on the server. Mitigation: There are several ways you can fix this vulnerability: 1) Upgrade to the latest version of Roller, which is now 5.1.2. 2) Or, add the following line to Roller's velocity.properties file: runtime.introspector.uberspect=org.apache.velocity.util.introspection.SecureUberspector 3) Or, disable template editing on your Roller system by un-checking the Allow Custom Themes setting in the Server Admin -> Configuration page, Theme Settings section. Credit: This issue was discovered by Gregory Draperi.
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.