~ / search / GHSA-px4w-rcv2-6x8x

GHSA-px4w-rcv2-6x8x

Arbitrary code execution in Apache ServiceComb java-chassis

Source: GitHub Advisory Database (reviewed) High CVE-2020-17532

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.servicecomb:java-chassis >= 1.0.0, < 1.3.2 1.3.2
Maven org.apache.servicecomb:java-chassis >= 2.0.0, < 2.1.5 2.1.5

Details

As written in the advisory (Markdown source, shown as plain text).

When handler-router component is enabled in servicecomb-java-chassis, authenticated user may inject some data and cause arbitrary code execution. The problem happens in versions between 2.0.0 ~ 2.1.3 and fixed in Apache ServiceComb-Java-Chassis 2.1.5

References

External links from the advisory. They lead to third-party sites.