oss-security - [CVE-2020-9483] Apache SkyWalking SQL injection vulnerability

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Date: Mon, 15 Jun 2020 15:45:55 +0800
From: Sheng Wu <wusheng@...che.org>
To: oss-security@...ts.openwall.com
Subject: [CVE-2020-9483] Apache SkyWalking SQL injection vulnerability

[CVEID]:CVE-2020-9483
[PRODUCT]:Apache SkyWalking
[VERSION]:Apache SkyWalking 6.0.0 to 6.6.0, 7.0.0
[PROBLEMTYPE]:SQL Injection
[DESCRIPTION]: When use H2/MySQL/TiDB as Apache SkyWalking storage, the
metadata query through GraphQL protocol, there is a SQL injection
vulnerability,
               which allows to access unpexcted data. Apache SkyWalking
6.0.0 to 6.6.0, 7.0.0 H2/MySQL/TiDB storage implementations don't use the
appropriate
               way to set SQL parameters.

Sheng Wu 吴晟
Twitter, wusheng1108

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.