Date: Wed, 26 Sep 2018 22:56:04 +0300 From: Alexander Gerus <agerus@...dgain.com> To: oss-security@...ts.openwall.com Subject: Apache Ignite: CVE-2018-8018, CVE-2018-1273, CVE-2018-1274: Notification on available mitigation [CVE-2018-8018] Possible Execution of Arbitrary Code via Apache Ignite GridClientJdkMarshaller Severity: Important Vendor: GridGain Systems Versions Affected: GridGain Professional Edition 2.4.7 or earlier GridGain Ultimate and Enterprise Editions 8.4.7 or earlier Impact: An attacker can execute arbitrary code on Ignite nodes via GridClientJdkMarshaller deserialization endpoint in the case when Ignite classpath contains arbitrary vulnerable classes. Description: Apache Ignite serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be exploited if the one sends a specially prepared form of a serialized object to GridClientJdkMarshaller deserialization endpoint. Mitigation: All GridGain versions: make sure there are no vulnerable classes among your custom code used in GridGain. Ignite Professional Edition 2.4.7 or earlier users: upgrade to Ignite 2.4.8 or later version Ignite Ultimate and Enterprise Editions 8.4.7 or earlier users: upgrade to Ignite 8.4.8 or later version After version upgrade use IGNITE_MARSHALLER_WHITELIST and/or IGNITE_MARSHALLER_BLACKLIST system properties to define classes allowed for deserialization. Refer to documentation for more details: https://apacheignite.readme.io/docs/securing-data-deserialization <https://apacheignite.readme.io/docs/securing-data-deserialization> Credit: The vulnerability was discovered by Man Yue Mo of lgtm.com Reference: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8018 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8018> [CVE-2018-1273] [CVE-2018-1274] Apache Ignite impacted by security vulnerability in Spring Data Commons Severity: Important Vendor: GridGain Systems Versions Affected: GridGain Professional Edition 2.4.7 or earlier GridGain Ultimate and Enterprise Editions 8.4.7 or earlier Impact: An unauthenticated remote malicious user (or attacker) can issue requests against Spring Data REST or Spring Data Description: Apache Ignite utilizes Spring Data Common library for some of its components. The vulnerability affects Apache Ignite users who us Spring Data REST for access an Ignite cluster via HTTP and Spring Data. Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data’s projection-based request payload binding hat can lead to a remote code execution attack. Mitigation: Ignite Professional Edition 2.4.7 or earlier users: upgrade to Ignite 2.4.8 or later version Ignite Ultimate and Enterprise Editions 8.4.7 or earlier users: upgrade to Ignite 8.4.8 or later version Credit: Harendra Rai of NCR Corporation discovered the impact of the existing vulnerability on Apache Ignite. Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1273 <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1273> https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1274 <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1274> -- Alexander Gerus, On behalf of GridGain team. E agerus@...dgain.com gridgain.com Powered by Apache® Ignite™
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.