Date: Tue, 5 Jun 2018 17:11:11 +0000 From: "Rai, Harendra" <Harendra.Rai@....com> To: Denis Magda <dmagda@...che.org>, "announce@...che.org" <announce@...che.org>, dev <dev@...ite.apache.org>, "user@...ite.apache.org" <user@...ite.apache.org>, "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com> Subject: RE: [CVE-2014-0114]: Apache Ignite is vulnerable to existing CVE-2014-0114 I found other security issues and I have created a bug. https://issues.apache.org/jira/browse/IGNITE-8713 Harendra Rai Software Engineer NCR Corporation office: 770.495.2864 mobile: 248.787.2876 harendra.rai@....com<mailto:harendra.rai@....com> www.ncr.com<http://www.ncr.com> [cid:image003.png@...0405E.86F4AD70] From: Denis Magda [mailto:dmagda@...che.org] Sent: Friday, June 01, 2018 1:17 PM To: announce@...che.org; dev <dev@...ite.apache.org>; user@...ite.apache.org; oss-security@...ts.openwall.com; Rai, Harendra <Harendra.Rai@....com> Subject: [CVE-2014-0114]: Apache Ignite is vulnerable to existing CVE-2014-0114 [CVE-2014-0114]: Apache Ignite is vulnerable to existing CVE-2014-0114 Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Ignite 2.4 or earlier Impact: An attacker can execute arbitrary code on Ignite nodes in the case when Ignite classpath contains arbitrary vulnerable classes. Description: Apache Ignite used commons-beanutils-1.8.3.jar library which did not suppress the class property, which allowed remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1. Mitigation: • All Ignite versions: make sure there are no vulnerable classes among your custom code used in Apache Ignite. • Upgrade to Apache Ignite 2.5 or later version Credit: Harendra Rai of NCR Corporation discovered the impact of the existing vulnerability on Apache Ignite. References: * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0114<https://urldefense.proofpoint.com/v2/url?u=https-3A__cve.mitre.org_cgi-2Dbin_cvename.cgi-3Fname-3DCVE-2D2014-2D0114&d=DwMFaQ&c=gJN2jf8AyP5Q6Np0yWY19w&r=9MqLDuI-YOHfnUsZj8zKAiE5cb4pd-EqZwfbefzAn18&m=O7V5T4VKtGxA1W7Dnp3dZmxv7FT2fy722704x0eAntk&s=shK2q4cumx70o8xqWHBcY19R-DVSgNIy32P-zTTbJNo&e=> Content of type "text/html" skipped
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.