www-announce mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Anthony Baker <aba...@apache.org>
Subject [SECURITY] CVE-2017-12622 Apache Geode gfsh authorization vulnerability
Date Tue, 09 Jan 2018 22:07:14 GMT
CVE-2017-12622 Apache Geode gfsh authorization vulnerability

Severity:  Important

Vendor: The Apache Software Foundation

Versions Affected:  Apache Geode 1.0.0 through 1.2.1

When an authenticated user connects to a Geode cluster using the gfsh
tool with HTTP, the user is able to obtain status information and
control cluster members even without CLUSTER:MANAGE privileges.

Users of the affected versions should upgrade to Apache Geode 1.3.0 or later.

This issue was reported responsibly to the Apache Geode Security Team
by Patrick Rhomberg from Pivotal.

[1] https://issues.apache.org/jira/browse/GEODE-3685
[2] https://cwiki.apache.org/confluence/display/GEODE/Release+Notes#ReleaseNotes-SecurityVulnerabilities

The Geode PMC

View raw message