oss-sec mailing list archives
[CVE-2018-11774] Apache VCL SQL injection attack in VM management
From: Josh Thompson <jfthomps () apache org>
Date: Mon, 29 Jul 2019 11:55:34 -0400
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 CVE-2018-11774: Apache VCL SQL injection attack in VM management Severity: Medium Versions Affected: 2.1 through 2.5 Description: Apache VCL versions 2.1 through 2.5 do not properly validate form input when adding and removing VMs to and from hosts. The form data is then used in SQL statements. This allows for an SQL injection attack. Access to this portion of a VCL system requires admin level rights. Other layers of security seem to protect against malicious attack. However, all VCL systems running versions earlier than 2.5.1 should be upgraded or patched. Mitigation: Upgrade to 2.5.1 or apply patches from https://vcl.apache.org/ security.html Credit: This vulnerability was found and reported to the Apache VCL project by ADLab of Venustech. CVE Released: July 29th, 2019 -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEI0cOQm0VAdkhDARZSNnzl+fhyFkFAl0/FvcACgkQSNnzl+fh yFkinA/9ECNBbbzcUhhCIawkPhv3tc4w3iEKVzaY8q/cya1tco4iBqshqD1EXt+d 6MdNy3MTs9diXG/jD/hwuxl2hdtAi012fla7RjRwkq0Raoew2G08E9X6NlKCmbMr klDoMsZWCknITnlYS91IjZevrIZnz9emJLO4ub9So8CqBzjEinsXftgPeSYHgD0U ES1B1ThwOEaxTjoMJ3V6/kfC5Y5LLe/v9pwtZvggBY06X+4DCKt3Z/aCfvzGwPol iGCWhO9XobIoi8Z8garw6NqCDluHPWKTzb7Et8NS1y6xiuTTWAvfctpWOlPwN+cH 1gHyqG+W9LRj2+vYdG8RCaQKAZfeUB7myfNvSIvWAAABYbku0molCC+CJZbnC/qp vUdwde9V9fTU0jVFiMMX78zXENAWME/G4tDLfn8AQXb+EpJBTMAATqLcuzavjN5Q GUByhNIOWABbyCDXk/0/eGjZ+QwYL2iOenVx0Si86aLBgi9u7mORqihRjcj5l85j XijHgT5mlPyiQxE58KKUkF6Sa7cSlakO5Jpmfzfxy4gmoC3fnUQFjFOPhZsJ8NR7 jBB9VPJ65UWk/HVsuqaR8nQxM4JpcrDdaOIWgyey8ya60JRx3rWsAlmxe4ScUQyx lChlY5iZgKGGSoY9o/wXc9etEWUkfXxQ9pBCLKg4QUTMnUzN6Ao= =UDWM -----END PGP SIGNATURE-----
Current thread:
- [CVE-2018-11774] Apache VCL SQL injection attack in VM management Josh Thompson (Jul 29)