Updated velocity packages fix security vulnerability

2021-04-1222:59:59

Gentoo Foundation

advisories.mageia.org

329

velocity templates

arbitrary java code

arbitrary system commands

servlet container

untrusted users

cve-2020-13936

unix

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

60.9%

JSON

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2 (CVE-2020-13936).

OSVersionArchitecturePackageVersionFilename
Mageia7noarchvelocity< 1.7-22.1velocity-1.7-22.1.mga7
Mageia8noarchvelocity< 1.7-33.1velocity-1.7-33.1.mga8