You are viewing a plain text version of this content. The canonical link for it is here.
Posted to announce@apache.org by Xue Weiming <mi...@apache.org> on 2025/06/30 03:09:33 UTC
CVE-2024-39954: Apache EventMesh Runtime: SSRF
Severity: low
Affected versions:
- Apache EventMesh Runtime (org.apache.eventmesh:eventmesh-runtime) 1.6.0 through 1.11.0
Description:
CWE-918 Server-Side Request Forgery (SSRF) in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker can abuse functionality on the server to read or update internal resources.
Users are recommended to upgrade to version 1.12.0 or use the master branch , which fixes this issue.
Credit:
Mak1r 808 <80...@gmail.com> (reporter)
References:
https://eventmesh.apache.org
https://www.cve.org/CVERecord?id=CVE-2024-39954
Re: CVE-2024-39954: Apache EventMesh Runtime: SSRF
Posted by Arnout Engelen <en...@apache.org>.
Apologies, this was my oversight: I was still confirming the project had a plan for the release. The advisory is now pushed to https://www.cve.org/CVERecord?id=CVE-2024-39954
Kind regards,
Arnout
On 2025/08/19 12:43:00 PJ Fanning wrote:
> the CVE has not been published to cve.org - it is still in READY and not PUBLIC state in
> https://cveprocess.apache.org/cve5/CVE-2024-39954
>
> Can it be published to cve.org so that the announcement is more widely seen?
>
> On 2025/08/19 07:19:57 Eason Chen wrote:
> > The issue has been fixed in the master branch, and the community plans
> > to resolve it in the upcoming version 1.12 release scheduled for
> > October-November.
> >
> > On Mon, Jun 30, 2025 at 11:09 AM Xue Weiming <mi...@apache.org> wrote:
> > >
> > > Severity: low
> > >
> > > Affected versions:
> > >
> > > - Apache EventMesh Runtime (org.apache.eventmesh:eventmesh-runtime) 1.6.0 through 1.11.0
> > >
> > > Description:
> > >
> > > CWE-918 Server-Side Request Forgery (SSRF) in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker can abuse functionality on the server to read or update internal resources.
> > > Users are recommended to upgrade to version 1.12.0 or use the master branch , which fixes this issue.
> > >
> > > Credit:
> > >
> > > Mak1r 808 <80...@gmail.com> (reporter)
> > >
> > > References:
> > >
> > > https://eventmesh.apache.org
> > > https://www.cve.org/CVERecord?id=CVE-2024-39954
> > >
> > >
> > > ---------------------------------------------------------------------
> > > To unsubscribe, e-mail: users-unsubscribe@eventmesh.apache.org
> > > For additional commands, e-mail: users-help@eventmesh.apache.org
> > >
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: users-unsubscribe@eventmesh.apache.org
> > For additional commands, e-mail: users-help@eventmesh.apache.org
> >
> >
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@eventmesh.apache.org
> For additional commands, e-mail: users-help@eventmesh.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@eventmesh.apache.org
For additional commands, e-mail: users-help@eventmesh.apache.org
Re: CVE-2024-39954: Apache EventMesh Runtime: SSRF
Posted by PJ Fanning <fa...@apache.org>.
the CVE has not been published to cve.org - it is still in READY and not PUBLIC state in
https://cveprocess.apache.org/cve5/CVE-2024-39954
Can it be published to cve.org so that the announcement is more widely seen?
On 2025/08/19 07:19:57 Eason Chen wrote:
> The issue has been fixed in the master branch, and the community plans
> to resolve it in the upcoming version 1.12 release scheduled for
> October-November.
>
> On Mon, Jun 30, 2025 at 11:09 AM Xue Weiming <mi...@apache.org> wrote:
> >
> > Severity: low
> >
> > Affected versions:
> >
> > - Apache EventMesh Runtime (org.apache.eventmesh:eventmesh-runtime) 1.6.0 through 1.11.0
> >
> > Description:
> >
> > CWE-918 Server-Side Request Forgery (SSRF) in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker can abuse functionality on the server to read or update internal resources.
> > Users are recommended to upgrade to version 1.12.0 or use the master branch , which fixes this issue.
> >
> > Credit:
> >
> > Mak1r 808 <80...@gmail.com> (reporter)
> >
> > References:
> >
> > https://eventmesh.apache.org
> > https://www.cve.org/CVERecord?id=CVE-2024-39954
> >
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: users-unsubscribe@eventmesh.apache.org
> > For additional commands, e-mail: users-help@eventmesh.apache.org
> >
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@eventmesh.apache.org
> For additional commands, e-mail: users-help@eventmesh.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@eventmesh.apache.org
For additional commands, e-mail: users-help@eventmesh.apache.org
Re: CVE-2024-39954: Apache EventMesh Runtime: SSRF
Posted by Eason Chen <ch...@apache.org>.
The issue has been fixed in the master branch, and the community plans
to resolve it in the upcoming version 1.12 release scheduled for
October-November.
On Mon, Jun 30, 2025 at 11:09 AM Xue Weiming <mi...@apache.org> wrote:
>
> Severity: low
>
> Affected versions:
>
> - Apache EventMesh Runtime (org.apache.eventmesh:eventmesh-runtime) 1.6.0 through 1.11.0
>
> Description:
>
> CWE-918 Server-Side Request Forgery (SSRF) in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker can abuse functionality on the server to read or update internal resources.
> Users are recommended to upgrade to version 1.12.0 or use the master branch , which fixes this issue.
>
> Credit:
>
> Mak1r 808 <80...@gmail.com> (reporter)
>
> References:
>
> https://eventmesh.apache.org
> https://www.cve.org/CVERecord?id=CVE-2024-39954
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@eventmesh.apache.org
> For additional commands, e-mail: users-help@eventmesh.apache.org
>
Re: CVE-2024-39954: Apache EventMesh Runtime: SSRF
Posted by Eason Chen <ch...@apache.org>.
The issue has been fixed in the master branch, and the community plans
to resolve it in the upcoming version 1.12 release scheduled for
October-November.
On Mon, Jun 30, 2025 at 11:09 AM Xue Weiming <mi...@apache.org> wrote:
>
> Severity: low
>
> Affected versions:
>
> - Apache EventMesh Runtime (org.apache.eventmesh:eventmesh-runtime) 1.6.0 through 1.11.0
>
> Description:
>
> CWE-918 Server-Side Request Forgery (SSRF) in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker can abuse functionality on the server to read or update internal resources.
> Users are recommended to upgrade to version 1.12.0 or use the master branch , which fixes this issue.
>
> Credit:
>
> Mak1r 808 <80...@gmail.com> (reporter)
>
> References:
>
> https://eventmesh.apache.org
> https://www.cve.org/CVERecord?id=CVE-2024-39954
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@eventmesh.apache.org
> For additional commands, e-mail: users-help@eventmesh.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@eventmesh.apache.org
For additional commands, e-mail: users-help@eventmesh.apache.org