You are viewing a plain text version of this content. The canonical link for it is here.
Posted to reviews@aurora.apache.org by GitBox <gi...@apache.org> on 2019/09/17 00:25:16 UTC
[GitHub] [aurora] larrycameron80 opened a new issue #82: Arbitrary Code
Injection
larrycameron80 opened a new issue #82: Arbitrary Code Injection
URL: https://github.com/apache/aurora/issues/82
Arbitrary Code Injection
Vulnerable module: jline:jline
Introduced through: org.apache.zookeeper:zookeeper@3.4.8, org.apache.curator:curator-client@2.12.0 and others
Detailed paths
Introduced through: apache/aurora@apache/aurora#ea8e2f4d905e26b3b999e8b59a3cb74a08a3dbf5 › org.apache.zookeeper:zookeeper@3.4.8 › jline:jline@0.9.94
Remediation: Upgrade to org.apache.zookeeper:zookeeper@3.5.5.
Introduced through: apache/aurora@apache/aurora#ea8e2f4d905e26b3b999e8b59a3cb74a08a3dbf5 › org.apache.curator:curator-client@2.12.0 › org.apache.zookeeper:zookeeper@3.4.8 › jline:jline@0.9.94
Introduced through: apache/aurora@apache/aurora#ea8e2f4d905e26b3b999e8b59a3cb74a08a3dbf5 › org.apache.curator:curator-framework@2.12.0 › org.apache.curator:curator-client@2.12.0 › org.apache.zookeeper:zookeeper@3.4.8 › jline:jline@0.9.94
Introduced through: apache/aurora@apache/aurora#ea8e2f4d905e26b3b999e8b59a3cb74a08a3dbf5 › org.apache.curator:curator-recipes@2.12.0 › org.apache.curator:curator-framework@2.12.0 › org.apache.curator:curator-client@2.12.0 › org.apache.zookeeper:zookeeper@3.4.8 › jline:jline@0.9.94
Overview
jline:jline is a Java library for handling console input.
Affected versions of this package are vulnerable to Arbitrary Code Injection. Race condition in hawtjni-runtime/src/main/java/org/fusesource/hawtjni/runtime/Library.java in HawtJNI before 1.8, when a custom library path is not specified, allows local users to execute arbitrary Java code by overwriting a temporary JAR file with a predictable name in /tmp.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services