Date: Thu, 14 May 2020 15:11:14 +0800 (GMT+08:00) From: ShannonDing <dinglei@...che.org> To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com> Cc: "private@...ketmq.apache.org" <private@...ketmq.apache.org> Subject: [SECURITY][CVE-2019-17572] Apache RocketMQ directory traversal vulnerability Hi, An directory traversal vulnerability was discovered in the version RocketMQ 4.6.0 and it affect all versions earlier. And it was fixed in the version 4.6.1 and later according to the CVE-2019-17572. Here is the detail of the vulnerability below: [CVEID]:CVE-2019-17572 [PRODUCT]:Apache RocketMQ [VERSIONS]:Apache RocketMQ 4.2.0 to 4.6.0 [PROBLEMTYPE]: Directory traversal vulnerability [REFERENCES]:https://lists.apache.org/thread.html/fdea1c5407da47a17d5522fa149a097cacded1916c1c1534d46edc6d%40%3Cprivate.rocketmq.apache.org%3E [DESCRIPTION]:When the automatic topic creation in the broker is turned on by default, an evil topic like “../../../../topic2020” is sent from rocketmq-client to the broker, a topic folder will be created in the parent directory in brokers, which leads to a directory traversal vulnerability. [MITIGATION]: Users of the affected versions should apply one of the following: mitigations: - Upgrade to Apache RocketMQ 4.6.1or later https://github.com/apache/rocketmq/issues/1637 https://lists.apache.org/thread.html/rce631288364c30332ad2ca3f3b72cae19f34ced3ba9bb0d58ebea1ff%40%3Cprivate.rocketmq.apache.org%3E
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.