GitHub Advisoryadvisory · Maven
GHSA-xv7x-x6wr-xx7g Apache Ranger policy engine incorrectly matches paths in certain conditions
MEDIUM
Official page ↗
- Aliases
- CVE-2016-8746
- Ecosystem
- Maven
- Packages
- org.apache.ranger:ranger-plugins-common
- Severity
- Moderate
- CVSS vector
- CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- Weaknesses
- CWE-426
- Reviewed
- 2020-06-16
Affected packages
• Maven org.apache.ranger:ranger-plugins-common: < 0.6.3 → fixed in 0.6.3
Description
Apache Ranger before 0.6.3 policy engine incorrectly matches paths in certain conditions when policy does not contain wildcards and has recursion flag set to true.
Related
Alias · CVE (1)
- CVE-2016-8746 Apache Ranger before 0.6.3 policy engine incorrectly matches paths in certain conditions when policy does not contain wildcards and has… vulnerability
Weakness · CWE (1)
- CWE-426 Untrusted Search Path weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2016-8746 advisory
- https://github.com/apache/ranger/commit/2fcd7f7cc175c0734443638b99c359e24c0f88ff web
- https://cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger web
- https://github.com/advisories/GHSA-xv7x-x6wr-xx7g advisory
- http://www.securityfocus.com/bid/95998 web