Date: Wed, 5 Aug 2020 20:59:26 +0800 From: Sheng Wu <wusheng@...che.org> To: oss-security@...ts.openwall.com Subject: [CVE-2020-13921] Apache SkyWalking SQL injection vulnerability after H2/MySQL/TiDB storage option activated. [CVEID]:CVE-2020-13921 [PRODUCT]:Apache SkyWalking [VERSION]:Apache SkyWalking 6.5.0, 6.6.0, 7.0.0, 8.0.0, 8.0.1 [PROBLEMTYPE]:SQL Injection [REFERENCES]:https://github.com/apache/skywalking/pull/4970 [DESCRIPTION]:**Resolved** Only when using H2/MySQL/TiDB as Apache SkyWalking storage, there is a SQL injection vulnerability in the wildcard query cases. [ASSIGNINGCNA]: Apache Software Foundation Sheng Wu 吴晟 Twitter, wusheng1108
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.