PT-2017-19191 · Apache · Apache Geode

Publicado 2017-09-29 · Atualizado 2022-05-17 · CVE-2017-9794

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Geode versions prior to 1.2.1

Description The issue allows a user with read privileges for specific data regions to potentially view unauthorized data when executing queries using the gfsh command line utility in secure mode. This can occur when query results contain data from another user's concurrently executing gfsh query.

Recommendations For Apache Geode versions prior to 1.2.1, update to version 1.2.1 or later to resolve the issue.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2017-9794

GHSA-37M3-QP37-X3C6

Produtos afetados

Apache Geode

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2017-9794 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-9794 · Aviso do Fabricante
• http://mail-archives.apache.org/mod_mbox/geode-user/201709.mbox/%3cCAEwge-FqzrT+deCkNkM-EQZuKfg-XuqY4cGjFiqxoKBVduY1Zw%40mail.gmail.com%3e · Nota
• https://issues.apache.org/jira/browse/GEODE-3217 · Nota
• https://lists.apache.org/thread/403xxbfrh4csyj1st7351g2dkm0hb91v · Nota
• https://osv.dev/vulnerability/GHSA-37m3-qp37-x3c6 · Aviso do Fabricante