GHSA-hp5w-w29m-vg63

Apache Accumulo Improper Authentication vulnerability

Source: GitHub Advisory Database (reviewed) Critical CVE-2023-34340

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.apache.accumulo:accumulo-shell	>= 2.1.0, < 2.1.1	2.1.1

Details

As written in the advisory (Markdown source, shown as plain text).

Improper Authentication vulnerability in Apache Software Foundation Apache Accumulo. This issue affects Apache Accumulo: 2.1.0. Accumulo 2.1.0 contains a defect in the user authentication process that may succeed when invalid credentials are provided. Users are advised to upgrade to 2.1.1.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-34340 advisory
https://github.com/apache/accumulo/issues/3427 web
https://github.com/apache/accumulo/issues/3433 web
https://github.com/apache/accumulo/pull/3440 web
https://github.com/apache/accumulo/commit/0f2389735fd32e0bbc93ecde5d8c814b275b21b5 web
https://accumulo.apache.org/release/accumulo-2.1.1 web
https://github.com/apache/accumulo package
https://lists.apache.org/thread/syy6jftvy9l6tlhn33o0rzwhh4rd0z4t web