oss-security - [SECURITY][CVE-2019-17572] Apache RocketMQ directory traversal vulnerability

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 14 May 2020 15:11:14 +0800 (GMT+08:00)
From: ShannonDing <dinglei@...che.org>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Cc: "private@...ketmq.apache.org" <private@...ketmq.apache.org>
Subject: [SECURITY][CVE-2019-17572] Apache RocketMQ directory traversal
 vulnerability

Hi, 
An directory traversal vulnerability[1] was discovered in the version RocketMQ 4.6.0 and it affect all
versions earlier. And it was fixed[2] in the version 4.6.1 and later according to the CVE-2019-17572.
Here is the detail of the vulnerability below:


[CVEID]:CVE-2019-17572
[PRODUCT]:Apache RocketMQ
[VERSIONS]:Apache RocketMQ 4.2.0 to 4.6.0
[PROBLEMTYPE]: Directory traversal vulnerability
[REFERENCES]:https://lists.apache.org/thread.html/fdea1c5407da47a17d5522fa149a097cacded1916c1c1534d46edc6d%40%3Cprivate.rocketmq.apache.org%3E
[DESCRIPTION]:When the automatic topic creation in the broker is turned on by default, an evil topic like “../../../../topic2020” is sent from rocketmq-client to the broker,  a topic folder will be created in the parent directory in brokers, which leads to a directory traversal vulnerability.
[MITIGATION]: Users of the affected versions should apply one of the following:
mitigations:
- Upgrade to Apache RocketMQ 4.6.1or later


[1]https://github.com/apache/rocketmq/issues/1637
[2]https://lists.apache.org/thread.html/rce631288364c30332ad2ca3f3b72cae19f34ced3ba9bb0d58ebea1ff%40%3Cprivate.rocketmq.apache.org%3E

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.