PT-2017-19191 · Apache · Apache Geode

Published 2017-09-29 · Updated 2022-05-17 · CVE-2017-9794

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Geode versions prior to 1.2.1

Description The issue allows a user with read privileges for specific data regions to potentially view unauthorized data when executing queries using the gfsh command line utility in secure mode. This can occur when query results contain data from another user's concurrently executing gfsh query.

Recommendations For Apache Geode versions prior to 1.2.1, update to version 1.2.1 or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-9794

GHSA-37M3-QP37-X3C6

Affected Products

Apache Geode

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2017-9794 · Security Note
• https://osv.dev/vulnerability/CVE-2017-9794 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-37m3-qp37-x3c6 · Vendor Advisory
• http://mail-archives.apache.org/mod_mbox/geode-user/201709.mbox/%3cCAEwge-FqzrT+deCkNkM-EQZuKfg-XuqY4cGjFiqxoKBVduY1Zw%40mail.gmail.com%3e · Note
• https://issues.apache.org/jira/browse/GEODE-3217 · Note
• https://lists.apache.org/thread/403xxbfrh4csyj1st7351g2dkm0hb91v · Note