PT-2018-10816 · Apache · Apache Ranger

Alexander Klink · Published 2018-10-05 · Updated 2020-08-24 · CVE-2018-11778

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Ranger versions prior to 1.2.0

Description The issue concerns a Stack-based buffer overflow that was addressed by updating the UnixAuthenticationService in Apache Ranger to correctly handle user input.

Recommendations For versions prior to 1.2.0, upgrade to version 1.2.0 to resolve the issue.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2018-11778

GHSA-C99H-FGQM-6679

Affected Products

Apache Ranger

References · 10

• https://cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-11778 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c99h-fgqm-6679 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-11778 · Security Note
• https://lists.apache.org/thread.html/r04bc435a92911de4b52d2b98f169bd7cf2e8bbeb53b03788df8f932c%40%3Cdev.ranger.apache.org%3E · Note
• https://lists.apache.org/thread.html/rd88077a781ef38f7687c100f93992f4dda8aa101925050c4af470998%40%3Cdev.ranger.apache.org%3E · Note
• https://lists.apache.org/thread.html/rd88077a781ef38f7687c100f93992f4dda8aa101925050c4af470998@%3Cdev.ranger.apache.org%3E · Note
• https://seclists.org/oss-sec/2018/q4/11 · Note
• https://lists.apache.org/thread.html/r04bc435a92911de4b52d2b98f169bd7cf2e8bbeb53b03788df8f932c@%3Cdev.ranger.apache.org%3E · Note
• https://github.com/advisories/GHSA-c99h-fgqm-6679 · Note