Received-SPF: pass (google.com: domain of oss-security-return-30069-linux.lists.archive=gmail.com@lists.openwall.com designates 193.110.157.125 as permitted sender) client-ip=193.110.157.125;
Mailing-List: contact oss-security-help@lists.openwall.com; run by ezmlm
Precedence: bulk
Reply-To: oss-security@lists.openwall.com
MIME-Version: 1.0
References: <CA+th4M+hZFd+u7zGbHhJ9acv0WFnOs95JiDek0ZWocCw+fN_5g@mail.gmail.com>
In-Reply-To: <CA+th4M+hZFd+u7zGbHhJ9acv0WFnOs95JiDek0ZWocCw+fN_5g@mail.gmail.com>
From: Imba Jin <jin@apache.org>
Date: Mon, 22 Apr 2024 15:37:38 +0800
Message-ID: <CA+th4MLqu7Fb+XM_RZxBcFMJJAnhoPqKWMMmWGCCg1j_YA2x8A@mail.gmail.com>
To: oss-security@lists.openwall.com
Content-Type: text/plain; charset="UTF-8"
Subject: [oss-security] CVE-2024-27348: Apache HugeGraph-Server: Command execution in gremlin

Severity: important

Affected versions:

- Apache HugeGraph-Server 1.0.0 before 1.3.0

Description:

RCE-Remote Command Execution vulnerability in Apache
HugeGraph-Server.This issue affects Apache HugeGraph-Server: from
1.0.0 before 1.3.0 in Java8 & Java11

Users are recommended to upgrade to version 1.3.0 with Java11 & enable
the Auth system, which fixes the issue.

Also you could enable the "Whitelist-IP/port" function to improve the
security of RESTful-API execution

Credit:

6right of moresec (reporter)

References:

https://hugegraph.apache.org/docs/config/config-authentication/#configure-user-authentication
https://hugegraph.apache.org/docs/download/download/
https://www.cve.org/CVERecord?id=CVE-2024-27348