oss-sec mailing list archives
Issues fixed in previous releases of Apache Zeppelin 0.7.3 and 0.8.0 (CVE-2017-12619 CVE-2018-1317 CVE-2018-1328)
From: Apache Security Team <security () apache org>
Date: Tue, 23 Apr 2019 08:29:28 +0100
The following three issues were fixed in previous releases of Apache Zeppelin but had not been disclosed. This email is being sent by the ASF Security Team on behalf of Apache Zeppelin. [CVEID]:CVE-2017-12619 [PRODUCT]:Apache Zeppelin [VERSION]:Apache Zeppelin prior to 0.7.3 (released September 2017) [PROBLEMTYPE]:Session Fixation [REFERENCES]:https://zeppelin.apache.org/releases/zeppelin-release-0.7.3.html [DESCRIPTION]: Apache Zeppelin prior to 0.7.3 was vulnerable to session fixation which allowed an attacker to hijack a valid user session. Issue was reported by "stone lone". [CVEID]:CVE-2018-1317 [PRODUCT]:Apache Zeppelin [VERSION]:Apache Zeppelin prior to 0.8.0 (released July 2018) [PROBLEMTYPE]:Improper Authentication [REFERENCES]:https://zeppelin.apache.org/releases/zeppelin-release-0.8.0.html [DESCRIPTION]: In Apache Zeppelin prior to 0.8.0 the cron scheduler was enabled by default and could allow users to run paragraphs as other users without authentication. [CVEID]:CVE-2018-1328 [PRODUCT]:Apache Zeppelin [VERSION]:Apache Zeppelin prior to 0.8.0 (released July 2018) [PROBLEMTYPE]:Stored XSS [REFERENCES]:https://zeppelin.apache.org/releases/zeppelin-release-0.8.0.html [DESCRIPTION]: Apache Zeppelin prior to 0.8.0 had a stored XSS issue via Note permissions. Issue reported by "Josna Joseph"
Current thread:
- Issues fixed in previous releases of Apache Zeppelin 0.7.3 and 0.8.0 (CVE-2017-12619 CVE-2018-1317 CVE-2018-1328) Apache Security Team (Apr 23)