Re: [oss-security] CVE-2022-23944: Apache ShenYu 2.4.1 Improper access control

[Zhang Yonglun <zh...@apache.org>]

Hi Alan,

Thanks a lot for your suggestions and these examples. I have updated
the contents to make the announcements clearer and more detailed.

--

Zhang Yonglun
Apache ShenYu (Incubating)
Apache ShardingSphere

Alan Coopersmith <al...@oracle.com> 于2022年1月26日周三 06:27写道：
>
> On 1/25/22 03:39, Zhang Yonglun wrote:
> > Description:
> >
> > User can access /plugin api without authentication. This issue
> > affected Apache ShenYu 2.4.0 and 2.4.1.
>
> Thanks for informing oss-security of these issues, but good security
> announcements have a little more detail, like what actions users or
> distributors need to take (upgrade to a new version?  what version?)
> and information on where to find more details, like a bug id in your
> bug tracker.  If you look at the announcements from other Apache
> projects, you'll see they often include those.
>
> Some good examples:
> https://www.openwall.com/lists/oss-security/2021/12/18/2
> https://www.openwall.com/lists/oss-security/2022/01/05/4
> https://www.openwall.com/lists/oss-security/2022/01/06/2
>
> --
>          -Alan Coopersmith-                 alan.coopersmith@oracle.com
>           Oracle Solaris Engineering - https://blogs.oracle.com/solaris