You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@ambari.apache.org by "Robert Levas (JIRA)" <ji...@apache.org> on 2018/07/13 15:20:00 UTC

[jira] [Created] (AMBARI-24288) Remove org.apache.directory.api:api-ldap-model from Ambari server's dependencies due to security concerns

Robert Levas created AMBARI-24288:
-------------------------------------

             Summary: Remove org.apache.directory.api:api-ldap-model from Ambari server's dependencies due to security concerns
                 Key: AMBARI-24288
                 URL: https://issues.apache.org/jira/browse/AMBARI-24288
             Project: Ambari
          Issue Type: Bug
          Components: ambari-server
    Affects Versions: 2.7.0
            Reporter: Robert Levas
            Assignee: Robert Levas
             Fix For: 2.7.1


Remove {{org.apache.directory.api:api-ldap-model}} from Ambari server's dependencies due to security concerns regarding the following CVE:

* CVE-2018-1337: Plaintext Password Disclosure in Secured Channel

See https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-1337

Though Ambari server includes {{api-ldap-model-1.0.0.jar}} in {{/usr/lib/ambari-server}}, the library is not used.  Therefore, the vulnerability is not exposed and the library may be excluded from Ambari's package. 




--
This message was sent by Atlassian JIRA
(v7.6.3#76005)