GHSA-wc6f-cjcp-cc33
Improper Certificate Validation in Apache IoTDB
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.apache.iotdb:iotdb-parent | < 0.9.2 | 0.9.2 |
Details
As written in the advisory (Markdown source, shown as plain text).
An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2. When starting IoTDB, the JMX port 31999 is exposed with no certification.Then, clients could execute code remotely.
References
External links from the advisory. They lead to third-party sites.