Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 23 Apr 2019 08:29:28 +0100
From: Apache Security Team <security@...che.org>
To: oss-security@...ts.openwall.com
Subject: Issues fixed in previous releases of Apache Zeppelin 0.7.3 and 0.8.0
 (CVE-2017-12619 CVE-2018-1317 CVE-2018-1328)

The following three issues were fixed in previous releases of Apache
Zeppelin but had not been disclosed.  This email is being sent by the
ASF Security Team on behalf of Apache Zeppelin.

[CVEID]:CVE-2017-12619
[PRODUCT]:Apache Zeppelin
[VERSION]:Apache Zeppelin prior to 0.7.3 (released September 2017)
[PROBLEMTYPE]:Session Fixation
[REFERENCES]:https://zeppelin.apache.org/releases/zeppelin-release-0.7.3.html
[DESCRIPTION]: Apache Zeppelin prior to 0.7.3 was vulnerable to
session fixation which allowed an attacker to hijack a valid user
session.  Issue was reported by "stone lone".

[CVEID]:CVE-2018-1317
[PRODUCT]:Apache Zeppelin
[VERSION]:Apache Zeppelin prior to 0.8.0 (released July 2018)
[PROBLEMTYPE]:Improper Authentication
[REFERENCES]:https://zeppelin.apache.org/releases/zeppelin-release-0.8.0.html
[DESCRIPTION]: In Apache Zeppelin prior to 0.8.0 the cron scheduler
was enabled by default and could allow users to run paragraphs as
other users without authentication.

[CVEID]:CVE-2018-1328
[PRODUCT]:Apache Zeppelin
[VERSION]:Apache Zeppelin prior to 0.8.0 (released July 2018)
[PROBLEMTYPE]:Stored XSS
[REFERENCES]:https://zeppelin.apache.org/releases/zeppelin-release-0.8.0.html
[DESCRIPTION]: Apache Zeppelin prior to 0.8.0 had a stored XSS issue
via Note permissions.  Issue reported by "Josna Joseph"

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.