Date: Mon, 27 Apr 2020 10:12:19 +0800 (GMT+08:00) From: "Dawei Liu" <liudw@...che.org> To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com> Subject: [CVE-2020-1952] Apache IoTDB (incubating) Remote Code execution vulnerability Severity: Important Vendor: The Apache Software Foundation Versions Affected: IoTDB 0.9.0 to 0.9.1 IoTDB 0.8.0 to 0.8.2 Description: When starting IoTDB, the JMX port 31999 is exposed with no certification. Then, clients could execute code remotely. Mitigation: 0.8.x, 0.9.0, and 0.9.1 users should upgrade to 0.9.2. Example: An Attacker can execute code remotely in the IoTDB server through JMX port. Credit: This issue was discovered by WuXiong of QI’ANXIN YunYing Lab. Regards, The Apache IoTDB team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.