Received: by 2002:ab2:7903:0:b0:1fb:b500:807b with SMTP id a3csp943574lqj;
        Mon, 3 Jun 2024 05:59:39 -0700 (PDT)
X-Forwarded-Encrypted: i=2; AJvYcCUTZlpyNxlj0a4d6Fe6yB6YXzVzlTI0DUPpW8E3nuqP/sXMrspKwhPwGBP2fP9Fuxm22okzMJMug8sufJyuBBj5+3F/BTO4SeGSMnocvw==
X-Google-Smtp-Source: AGHT+IEJmRAkd0uU9iGKdgPIet2fPLTFFUCW6WwgCrN2ZFd8IOZtwfLbtYoXZMYZilsMU7ODs1uL
X-Received: by 2002:a17:906:4746:b0:a69:2554:9c6 with SMTP id a640c23a62f3a-a6925540a01mr128761066b.6.1717419579079;
        Mon, 03 Jun 2024 05:59:39 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1717419579; cv=none;
        d=google.com; s=arc-20160816;
        b=a2GBhny5fDawLTJT/lrGLAv+2T20J3jT9yc3dvmVjiVhukWJYvXIcUAuN3I+B/uezc
         dVpOAJy5g6g8YlznajBUWDKHndg/jwwN/Ewem+af3VADuWd8yCMfpLMBbQCXcO4WVLIt
         KV5idVzYEh6oc9zC5/NevuNPM5RkF2ehGM3Pc+C6n8Vbj6P8LdA7BlmY9HI7xk/FWj+7
         Faw4QQLqZ7kOPStdEoPxbECjnkN/nzA69K0+ttzqp8ygBNXy2wqlkcy5XQHXXFYboAss
         u/71LaP1HNzCRve6JHe06/izjK+faWZntqmSiJzM9M8byFgRMw1Nk2qJqpnCttOxa2H7
         pl/w==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=subject:mime-version:date:content-transfer-encoding:message-id:to
         :from:delivered-to:delivered-to:reply-to:list-id:list-subscribe
         :list-unsubscribe:list-help:list-post:precedence:mailing-list;
        bh=FoAjTpuTJDvWflNg0T/ESkwbIgJdaPN6zAUxShdH23w=;
        fh=9jsPTyo6edd9xvAeG+KFFrRrXMmgB/RdwUKOrvy9dcA=;
        b=dJrMSftG63IsU96CKh00ACBGrIQrALY9cLb3xrGUDca6LOV0kRvEwD4K/+s5R27sZC
         DyHNABjA/PdroFdQcwsRvjQzDXGnNR1gX6MZI66C9Z7//+hT9UeMJhvWZgOIXp4bC5iK
         y2R0gSbpzGQj7rNdywEb1QD9D8GZu84zrwZxhjsCQg+7Wc+xzCXJHk7TX2SfK/9pKuzd
         WXncw02KYDR053+PkeOeiXTQnNimRs2y6jlFVIxaIOFxtqLg5jMTg98fsf7QqHcYOwlW
         pb87rgHq+ap0JxQHrE6lUi418VffTTUwGk82wtXV7Np0ZBNKLjJNQ8KS+wb/RRZf5rm7
         7b0A==;
        dara=google.com
ARC-Authentication-Results: i=1; mx.google.com;
       spf=pass (google.com: domain of oss-security-return-30178-linux.lists.archive=gmail.com@lists.openwall.com designates 193.110.157.125 as permitted sender) smtp.mailfrom="oss-security-return-30178-linux.lists.archive=gmail.com@lists.openwall.com"
Return-Path: <oss-security-return-30178-linux.lists.archive=gmail.com@lists.openwall.com>
Received: from second.openwall.net (second.openwall.net. [193.110.157.125])
        by mx.google.com with SMTP id a640c23a62f3a-a6918bdd3eesi74857066b.873.2024.06.03.05.59.38
        for <linux.lists.archive@gmail.com>;
        Mon, 03 Jun 2024 05:59:39 -0700 (PDT)
Received-SPF: pass (google.com: domain of oss-security-return-30178-linux.lists.archive=gmail.com@lists.openwall.com designates 193.110.157.125 as permitted sender) client-ip=193.110.157.125;
Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of oss-security-return-30178-linux.lists.archive=gmail.com@lists.openwall.com designates 193.110.157.125 as permitted sender) smtp.mailfrom="oss-security-return-30178-linux.lists.archive=gmail.com@lists.openwall.com"
Received: (qmail 3764 invoked by uid 550); 3 Jun 2024 12:59:19 -0000
Mailing-List: contact oss-security-help@lists.openwall.com; run by ezmlm
Precedence: bulk
List-Post: <mailto:oss-security@lists.openwall.com>
List-Help: <mailto:oss-security-help@lists.openwall.com>
List-Unsubscribe: <mailto:oss-security-unsubscribe@lists.openwall.com>
List-Subscribe: <mailto:oss-security-subscribe@lists.openwall.com>
List-ID: <oss-security.lists.openwall.com>
Reply-To: oss-security@lists.openwall.com
Delivered-To: mailing list oss-security@lists.openwall.com
Delivered-To: moderator for oss-security@lists.openwall.com
Received: (qmail 16140 invoked from network); 3 Jun 2024 06:55:36 -0000
Authentication-Results: apache.org; auth=none
Content-Type: text/plain; charset=utf-8
From: Jacques Le Roux <jleroux@apache.org>
To: oss-security@lists.openwall.com
Message-ID: <7b0c3814-6145-9317-63eb-28d86ed6fdc9@apache.org>
Content-Transfer-Encoding: quoted-printable
Date: Mon, 03 Jun 2024 06:55:25 +0000
MIME-Version: 1.0
Subject: [oss-security] CVE-2024-36104: Apache OFBiz: Path traversal leading to a RCE 

Severity: important

Affected versions:

- Apache OFBiz before 18.12.14

Description:

Improper Limitation of a Pathname to a Restricted Directory ('Path =
Traversal') vulnerability in Apache OFBiz.=C2=A0This issue affects Apache =
OFBiz: before 18.12.14.

Users are recommended to upgrade to version 18.12.14, which fixes the issue=
.

Credit:

godspeed (AAA@ZJU) (finder)

References:

https://ofbiz.apache.org/download.html
https://ofbiz.apache.org/security.html
https://issues.apache.org/jira/browse/OFBIZ-13092
https://lists.apache.org/thread/sv0xr8b1j7mmh5p37yldy9vmnzbodz2o
https://ofbiz.apache.org/
https://www.cve.org/CVERecord?id=3DCVE-2024-36104