From announce-return-4607-archive-asf-public=cust-asf.ponee.io@apache.org Tue Jun 12 23:36:34 2018 Return-Path: X-Original-To: archive-asf-public@cust-asf.ponee.io Delivered-To: archive-asf-public@cust-asf.ponee.io Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by mx-eu-01.ponee.io (Postfix) with SMTP id 7465C180608 for ; Tue, 12 Jun 2018 23:36:33 +0200 (CEST) Received: (qmail 66528 invoked by uid 500); 12 Jun 2018 21:36:30 -0000 Mailing-List: contact announce-help@apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Delivered-To: mailing list announce@apache.org Delivered-To: moderator for announce@apache.org Received: (qmail 17247 invoked by uid 99); 12 Jun 2018 21:14:28 -0000 X-Gm-Message-State: APt69E0L8xFNJeHmYb0uhtgY5ANZmbOiFhufyJkCz+DNV9UL7+oKLXJ/ gNcTycOgy+efSCJevlfBxaqI448eaNURspSVWsz/fx9iP/EBm1FZCVscW/gSwoOk0riPUNIGYIg C7pwmVQmuIPq9FyxpzLroS+CptTgDMQbtiTeznJbAZZ4fXM00bjNZvQ== X-Received: by 2002:a1f:5682:: with SMTP id k124-v6mr1378208vkb.19.1528838066405; Tue, 12 Jun 2018 14:14:26 -0700 (PDT) X-Google-Smtp-Source: ADUXVKK4/ENRtWMlbZTFxlM37ZXjPeMUx/tghMRB9kaR/wemCQI71BNxcDqLaEzozGrnRyyApgpPj3uEqysqxffh93I= X-Received: by 2002:a1f:5682:: with SMTP id k124-v6mr1378201vkb.19.1528838066309; Tue, 12 Jun 2018 14:14:26 -0700 (PDT) MIME-Version: 1.0 From: Anthony Baker Date: Tue, 12 Jun 2018 14:14:25 -0700 X-Gmail-Original-Message-ID: Message-ID: Subject: [SECURITY] CVE-2017-15695 Apache Geode remote code execution vulnerability To: announce@apache.org Content-Type: text/plain; charset="UTF-8" CVE-2017-15695 Apache Geode remote code execution vulnerability Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Geode 1.0.0 through 1.4.0 Description: When a Geode server is configured with a security manager, a user with DATA:WRITE privileges is allowed to deploy code by invoking an internal Geode function. This allows remote code execution. Code deployment should be restricted to users with DATA:MANAGE privilege. Mitigation: Users of the affected versions should upgrade to Apache Geode 1.5.0 or later. Credit: This issue was reported responsibly to the Apache Geode Security Team by Dan Smith from Pivotal Software. References: [1] https://issues.apache.org/jira/browse/GEODE-3974 [2] https://cwiki.apache.org/confluence/display/GEODE/Release+Notes#ReleaseNotes-SecurityVulnerabilities