Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 3 Jun 2020 13:31:52 +0300
From: Юрий <>
Subject: [CVE-2020-1963] Apache Ignite access to file system disclosure vulnerability

CVE-2020-1963: Apache Ignite access to file system through predefined H2
SQL functions

Severity: Critical

The Apache Software Foundation

Versions Affected:
All versions of Apache Ignite up to 2.8

An attacker can use embedded H2 SQL functions to access a filesystem for
write and read.

Apache Ignite uses H2 database to build SQL distributed execution engine.
H2 provides SQL functions which could be used by attacker to access to a

Ignite 2.8 or earlier users should upgrade to 2.8.1
In case SQL is not used at all the issue could be mitigated by removing
ignite-indexing.jar from Ignite classpath
Risk could be partially mitigated by using non privileged user to start
Apache Ignite.

This issue was discovered by Sriveena Mattaparthi of

Живи с улыбкой! :D

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.