PT-2021-8864 · Apache · Apache Zeppelin

Published 2021-09-02 · Updated 2023-11-24 · CVE-2019-10095

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Zeppelin versions 0.9.0 and prior versions

Description A bash command injection issue in Apache Zeppelin allows an attacker to inject system commands into Spark interpreter settings.

Recommendations For Apache Zeppelin versions 0.9.0 and prior, consider restricting access to the Spark interpreter settings to minimize the risk of exploitation until a fix is available.

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2019-10095

GHSA-4QW8-PGPR-P9MQ

Affected Products

Apache Zeppelin

References · 17

• https://security.gentoo.org/glsa/202311-04 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4qw8-pgpr-p9mq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10095 · Security Note
• https://osv.dev/vulnerability/CVE-2019-10095 · Vendor Advisory
• https://lists.apache.org/thread.html/rdf06e8423833b3daadc30c56a2ff47c48920864d5199476daa897208%40%3Cusers.zeppelin.apache.org%3E · Vendor Advisory
• https://github.com/apache/zeppelin · Note
• https://t.me/cvenotify/20592 · Telegram Post
• http://openwall.com/lists/oss-security/2021/09/02/1 · Note
• https://lists.apache.org/thread.html/rdf06e8423833b3daadc30c56a2ff47c48920864d5199476daa897208@%3Cusers.zeppelin.apache.org%3E · Note
• https://t.me/cvenotify/20821 · Telegram Post
• https://lists.apache.org/thread.html/rdf06e8423833b3daadc30c56a2ff47c48920864d5199476daa897208@%3Cannounce.apache.org%3E · Note
• https://lists.apache.org/thread.html/rd56389ba9cab30a6c976b9a4a6df0f85cbe8fba6a60a3cf6e3ba716b@%3Cusers.zeppelin.apache.org%3E · Note
• https://t.me/cvenotify/20618 · Telegram Post
• https://t.me/cvenotify/21557 · Telegram Post
• https://lists.apache.org/thread.html/rd56389ba9cab30a6c976b9a4a6df0f85cbe8fba6a60a3cf6e3ba716b%40%3Cusers.zeppelin.apache.org%3E · Note