GHSA-6g88-99wj-8mgg

Source

https://github.com/advisories/GHSA-6g88-99wj-8mgg

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-6g88-99wj-8mgg/GHSA-6g88-99wj-8mgg.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-6g88-99wj-8mgg

Aliases

Published

2021-05-21T19:20:35Z

Modified

2023-12-06T00:45:19.629868Z

Severity

4.7 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Command injection in Apache Flink

Details

A vulnerability in Apache Flink where, when running a process with an enabled JMXReporter, with a port configured via metrics.reporter.reporter_name>.port, an attacker with local access to the machine and JMX port can execute a man-in-the-middle attack using a specially crafted request to rebind the JMXRMI registry to one under the attacker's control. This compromises any connection established to the process via JMX, allowing extraction of credentials and any other transferred data.

Database specific

{
    "nvd_published_at": "2020-05-14T17:15:00Z",
    "github_reviewed_at": "2021-05-21T18:41:46Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-74"
    ]
}

References

Affected packages

Maven / org.apache.flink:flink-core

Package

Name: org.apache.flink:flink-core; View open source insights on deps.dev
Purl: pkg:maven/org.apache.flink/flink-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.9.3

Affected versions

0.*

0.6-hadoop2-incubating

0.6-incubating

0.6.1-hadoop2-incubating

0.6.1-incubating

0.7.0-hadoop2-incubating

0.7.0-incubating

0.8.0

0.8.0-hadoop1

0.8.1

0.8.1-hadoop1

0.9.0-milestone-1

0.9.0-milestone-1-hadoop1

0.9.0

0.9.0-hadoop1

0.9.1

0.9.1-hadoop1

0.10.0

0.10.0-hadoop1

0.10.1

0.10.1-hadoop1

0.10.2

0.10.2-hadoop1

1.*

1.0.0

1.0.0-hadoop1

1.0.1

1.0.1-hadoop1

1.0.2

1.0.2-hadoop1

1.0.3

1.0.3-hadoop1

1.1.0

1.1.1

1.1.1-hadoop1

1.1.2

1.1.2-hadoop1

1.1.3

1.1.3-hadoop1

1.1.4

1.1.4-hadoop1

1.1.5

1.1.5-hadoop1

1.2.0

1.2.1

1.3.0

1.3.1

1.3.2

1.3.3

1.4.0

1.4.1

1.4.2

1.5.0

1.5.1

1.5.2

1.5.3

1.5.4

1.5.5

1.5.6

1.6.0

1.6.1

1.6.2

1.6.3

1.6.4

1.7.0

1.7.1

1.7.2

1.8.0

1.8.1

1.8.2

1.8.3

1.9.0

1.9.1

1.9.2

Database specific

{
    "last_known_affected_version_range": "< 1.9.2"
}