PT-2025-9504 · Apache · Apache Ranger

김도균 · Publicado 2025-03-03 · Atualizado 2025-03-06 · CVE-2024-55532

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Ranger versions prior to 2.6.0

Description The issue concerns the Export CSV feature in Apache Ranger, where there is an improper neutralization of formula elements. Users are advised to upgrade to a fixed version to address this issue.

Recommendations For versions prior to 2.6.0, upgrade to version 2.6.0 to fix the issue.

Correção

RCE

Enumeração de Fraquezas

CWE-1236

Identificadores relacionados

CVE-2024-55532

GHSA-2H4W-P9FH-9RMV

Produtos afetados

Apache Ranger

Referências · 11

• https://github.com/apache/ranger · Nota
• https://github.com/apache/ranger/commit/8d89fec991f05bd92e28f459bc2b3a3024aaad82 · Nota
• https://twitter.com/CCBalert/status/1897646107334778954 · Publicação no Twitter
• https://cwiki.apache.org/confluence/display/RANGER/Apache+Ranger+2.6.0+-+Release+Notes · Nota
• https://cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger · Aviso do Fabricante
• https://issues.apache.org/jira/browse/RANGER-5015 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2024-55532 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-2h4w-p9fh-9rmv · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1896767612735914152 · Publicação no Twitter
• http://openwall.com/lists/oss-security/2025/03/03/2 · Nota
• https://osv.dev/vulnerability/CVE-2024-55532 · Aviso do Fabricante