From f58c50a7975c03de6d759665291ea0a79335dc47 Mon Sep 17 00:00:00 2001 From: Krzysztof Opasiak Date: Tue, 28 May 2019 13:24:32 +0200 Subject: Issue OSA for OJSI-63 Signed-off-by: Krzysztof Opasiak Change-Id: I7df4583d0ff0228ed5fb17e9945b3b0c2dfa564b --- osa/OSA-2019-007.rst | 39 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) create mode 100644 osa/OSA-2019-007.rst diff --git a/osa/OSA-2019-007.rst b/osa/OSA-2019-007.rst new file mode 100644 index 0000000..3a5737d --- /dev/null +++ b/osa/OSA-2019-007.rst @@ -0,0 +1,39 @@ +================================================================================================= +OSA-2019-007: APPC exposes Jolokia interface which allows to read and overwrite an arbitrary file +================================================================================================= + +**Date:** 2019-05-28 + +**CVE:** CVE-2019-12124 + +**Severity:** Critical + +Affects +------- + +* APPC: before Dublin + +Description +----------- + +Radosław Żeszczuk from Samsung reported a vulnerability in APPC. By using exposed unprotected Jolokia interface an unauthenticated attacker can read or overwrite arbitrary file. All APPC setups are affected. + +Patches +------- + +No exact patch provided by the maintainer. Issue fixed probably fixed with ODL upgrade. (Confirmed to not be present in Dublin) + +**Warning** +Dublin release is not vulnerable for this attack because the Jolokia interface is protected with basic HTTP authentication. +Unfortunately by default weak credentials are used which can be considered to be a security risk. + +Credits +------- + +* Radosław Żeszczuk from Samsung + +References +---------- + +* `OJSI-63 `_ +* `CVE-2019-12124 `_ -- cgit 1.2.3-korg