Date: Wed, 24 Jul 2019 09:26:18 +0200 From: Stig Rohde Døssing <srdo@...che.org> To: oss-security@...ts.openwall.com Subject: [CVE-2019-0202] Apache Storm Logviewer file system access vulnerability [CVEID]:CVE-2019-0202[PRODUCT]:Apache Storm[VERSION]:Apache Storm 0.9.1-incubating to 1.2.2[PROBLEMTYPE]:CWE-200: Information Exposure[DESCRIPTION]:The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm. In Apache Storm versions 0.9.1-incubating to 1.2.2, it is possible to read files off the host's file system that were not intended to be accessible via these endpoints. Mitigation: Upgrade to Apache Storm 1.2.3 or later. Credit: Stig Rohde Døssing for discovery and fix
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.