You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@ignite.apache.org by "VaishaliThisSide (via GitHub)" <gi...@apache.org> on 2024/04/19 11:17:25 UTC
[I] Is Ignite 2.16.0 impacted by CVE-2024-22243 ? [ignite]
VaishaliThisSide opened a new issue, #11322:
URL: https://github.com/apache/ignite/issues/11322
we got a vulnerability **https://spring.io/security/cve-2024-22243**
"Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a [open redirect](https://cwe.mitre.org/data/definitions/601.html) attack or to a SSRF attack if the URL is used after passing validation checks."
The latest ignite release` 2.16 `using spring` 5.2.25,`
1. Is ignite really vulnerable to CVE-2024-22243?
2. If the first one is true, we don't have any ignite version with non vulnerable Spring version. Are there any plans of Ignite to release the same?
Can you please have a look at this Urgently. This has a huge impact for us.
Thanks!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@ignite.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Is Ignite 2.16.0 impacted by CVE-2024-22243 ? [ignite]
Posted by "ptupitsyn (via GitHub)" <gi...@apache.org>.
ptupitsyn closed issue #11322: Is Ignite 2.16.0 impacted by CVE-2024-22243 ?
URL: https://github.com/apache/ignite/issues/11322
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@ignite.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Is Ignite 2.16.0 impacted by CVE-2024-22243 ? [ignite]
Posted by "ptupitsyn (via GitHub)" <gi...@apache.org>.
ptupitsyn commented on issue #11322:
URL: https://github.com/apache/ignite/issues/11322#issuecomment-2066419979
> Applications that use `UriComponentsBuilder`
Ignite does not use `UriComponentsBuilder` at all, not a single match in the source code: https://github.com/search?q=repo%3Aapache%2Fignite%20UriComponentsBuilder&type=code
Looks there is no issue.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@ignite.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org