[<prev] [next>] [day] [month] [year] [list]
Message-ID: <76ad9a70-bafd-df46-eafc-6507b264e606@apache.org>
Date: Sat, 12 Jul 2025 16:06:43 +0000
From: PJ Fanning <fanningpj@...che.org>
To: oss-security@...ts.openwall.com
Subject: https://issues.apache.org/jira/browse/ZEPPELIN-6101:
CVE-2024-41169: Apache Zeppelin: raft directory listing and file read
Severity: moderate
Affected versions:
- Apache Zeppelin (org.apache.zeppelin:zeppelin-server) 0.10.1 before 0.12.0
Description:
The attacker can use the raft server protocol in an unauthenticated way. The attacker can see the server's resources, including directories and files.
This issue affects Apache Zeppelin: from 0.10.1 up to 0.12.0.
Users are recommended to upgrade to version 0.12.0, which fixes the issue by removing the Cluster Interpreter.
Credit:
SuperX <superxyyang@...il.com> (finder)
References:
https://github.com/apache/zeppelin/pull/4841
https://zeppelin.apache.org/
https://www.cve.org/CVERecord?id=CVE-2024-41169
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
