You are viewing a plain text version of this content. The canonical link for it is here.

Posted to users@zeppelin.apache.org by Apache Security Team <se...@apache.org> on 2019/04/23 07:30:08 UTC

Issues fixed in previous releases of Apache Zeppelin 0.7.3 and 0.8.0 (CVE-2017-12619 CVE-2018-1317 CVE-2018-1328)

The following three issues were fixed in previous releases of Apache
Zeppelin but had not been disclosed.  This email is being sent by the
ASF Security Team on behalf of Apache Zeppelin.

[CVEID]:CVE-2017-12619
[PRODUCT]:Apache Zeppelin
[VERSION]:Apache Zeppelin prior to 0.7.3 (released September 2017)
[PROBLEMTYPE]:Session Fixation
[REFERENCES]:https://zeppelin.apache.org/releases/zeppelin-release-0.7.3.html
[DESCRIPTION]: Apache Zeppelin prior to 0.7.3 was vulnerable to
session fixation which allowed an attacker to hijack a valid user
session.  Issue was reported by "stone lone".

[CVEID]:CVE-2018-1317
[PRODUCT]:Apache Zeppelin
[VERSION]:Apache Zeppelin prior to 0.8.0 (released July 2018)
[PROBLEMTYPE]:Improper Authentication
[REFERENCES]:https://zeppelin.apache.org/releases/zeppelin-release-0.8.0.html
[DESCRIPTION]: In Apache Zeppelin prior to 0.8.0 the cron scheduler
was enabled by default and could allow users to run paragraphs as
other users without authentication.

[CVEID]:CVE-2018-1328
[PRODUCT]:Apache Zeppelin
[VERSION]:Apache Zeppelin prior to 0.8.0 (released July 2018)
[PROBLEMTYPE]:Stored XSS
[REFERENCES]:https://zeppelin.apache.org/releases/zeppelin-release-0.8.0.html
[DESCRIPTION]: Apache Zeppelin prior to 0.8.0 had a stored XSS issue
via Note permissions.  Issue reported by "Josna Joseph"