From dev-return-36737-apmail-ignite-dev-archive=ignite.apache.org@ignite.apache.org Thu Jul 19 17:04:45 2018 Return-Path: X-Original-To: apmail-ignite-dev-archive@minotaur.apache.org Delivered-To: apmail-ignite-dev-archive@minotaur.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id B64EA1878E for ; Thu, 19 Jul 2018 17:04:45 +0000 (UTC) Received: (qmail 2442 invoked by uid 500); 19 Jul 2018 17:04:45 -0000 Delivered-To: apmail-ignite-dev-archive@ignite.apache.org Received: (qmail 2391 invoked by uid 500); 19 Jul 2018 17:04:45 -0000 Mailing-List: contact dev-help@ignite.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: dev@ignite.apache.org Delivered-To: mailing list dev@ignite.apache.org Received: (qmail 2312 invoked by uid 99); 19 Jul 2018 17:04:45 -0000 Received: from mail-relay.apache.org (HELO mailrelay1-lw-us.apache.org) (207.244.88.152) by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 19 Jul 2018 17:04:45 +0000 Received: from mail-lj1-f173.google.com (mail-lj1-f173.google.com [209.85.208.173]) by mailrelay1-lw-us.apache.org (ASF Mail Server at mailrelay1-lw-us.apache.org) with ESMTPSA id 49C4AD09 for ; Thu, 19 Jul 2018 17:04:44 +0000 (UTC) Received: by mail-lj1-f173.google.com with SMTP id u7-v6so8563500lji.3 for ; Thu, 19 Jul 2018 10:04:44 -0700 (PDT) X-Gm-Message-State: AOUpUlHGf88Fp8Upp1eR9+Xxxfp5BSEpL3rIaiaq+aqy0I+mDIqzKXZO Y3zpJafXIQSHr+VNfa+bVGNud1BcCDFkkz99Bu0INg== X-Google-Smtp-Source: AAOMgpcUvNfKezL/PvYE0C86qEddZMB6qiR4yYOhPdRL1PAqFUzNsyZ4RmpMmls2T8D+8bzDItcDHicitp/2qim9XvA= X-Received: by 2002:a2e:8185:: with SMTP id e5-v6mr8778089ljg.93.1532019882767; Thu, 19 Jul 2018 10:04:42 -0700 (PDT) MIME-Version: 1.0 From: Denis Magda Date: Thu, 19 Jul 2018 10:04:16 -0700 X-Gmail-Original-Message-ID: Message-ID: Subject: [CVE-2018-1273] Apache Ignite impacted by security vulnerability in Spring Data Commons To: announce@apache.org, security@ignite.apache.org, Apache Security Team , "Rai, Harendra" , oss-security@lists.openwall.com Cc: user@ignite.apache.org, dev Content-Type: multipart/alternative; boundary="000000000000e6cf8b05715d2ccb" --000000000000e6cf8b05715d2ccb Content-Type: text/plain; charset="UTF-8" Severity: Important Vendor: The Apache Software Foundation Versions Affected: * Apache Ignite 1.0.0-RC3 to 2.5 Impact: An unauthenticated remote malicious user (or attacker) can issue requests against Spring Data REST or Spring Data Description: Apache Ignite utilizes Spring Data Common library for some of its components. The vulnerability affects Apache Ignite users who us Spring Data REST for access an Ignite cluster via HTTP and Spring Data. Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack. Mitigation: * Upgrade to Apache Ignite 2.6 or later that include Spring Data Commons versions not vulnerable to the disclosed issue. Credit: * Harendra Rai of NCR Corporation discovered the impact of the existing vulnerability on Apache Ignite. References: * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1273 * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1274 --000000000000e6cf8b05715d2ccb--