PT-2018-10816 · Apache · Apache Ranger

Alexander Klink · Publicado 2018-10-05 · Atualizado 2020-08-24 · CVE-2018-11778

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Ranger versions prior to 1.2.0

Description The issue concerns a Stack-based buffer overflow that was addressed by updating the UnixAuthenticationService in Apache Ranger to correctly handle user input.

Recommendations For versions prior to 1.2.0, upgrade to version 1.2.0 to resolve the issue.

Correção

Memory Corruption

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

CVE-2018-11778

GHSA-C99H-FGQM-6679

Produtos afetados

Apache Ranger

Referências · 10

• https://lists.apache.org/thread.html/r04bc435a92911de4b52d2b98f169bd7cf2e8bbeb53b03788df8f932c%40%3Cdev.ranger.apache.org%3E · Nota
• https://cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-11778 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-c99h-fgqm-6679 · Aviso do Fabricante
• https://lists.apache.org/thread.html/rd88077a781ef38f7687c100f93992f4dda8aa101925050c4af470998%40%3Cdev.ranger.apache.org%3E · Nota
• https://lists.apache.org/thread.html/rd88077a781ef38f7687c100f93992f4dda8aa101925050c4af470998@%3Cdev.ranger.apache.org%3E · Nota
• https://seclists.org/oss-sec/2018/q4/11 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-11778 · Nota de Segurança
• https://lists.apache.org/thread.html/r04bc435a92911de4b52d2b98f169bd7cf2e8bbeb53b03788df8f932c@%3Cdev.ranger.apache.org%3E · Nota
• https://github.com/advisories/GHSA-c99h-fgqm-6679 · Nota