GHSA-9x2h-hvg6-4r5p

Improper Authentication in Apache Zeppelin

Source: GitHub Advisory Database (reviewed) High CVE-2018-1317

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.apache.zeppelin:zeppelin	< 0.8.0	0.8.0

Details

As written in the advisory (Markdown source, shown as plain text).

In Apache Zeppelin prior to 0.8.0 the cron scheduler was enabled by default and could allow users to run paragraphs as other users without authentication.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-1317 advisory
https://lists.apache.org/thread.html/ff6b995a5a3ba8db4d6b14b4d9dd487e7bf2e3bdd5b375b64a25fd06@%3Cusers.zeppelin.apache.org%3E web
https://zeppelin.apache.org/releases/zeppelin-release-0.8.0.html web
http://www.openwall.com/lists/oss-security/2019/04/23/1 web