apache__rocketmq_CVE-2019-17572_4-6-0

Apache RocketMQ Apache RocketMQ is a distributed messaging and streaming platform with low latency, high performance and reliability, trillion-level capacity and flexible scalability. It offers a variety of features: Pub/Sub messaging model Financial grade transactional message A variety of cross...

CVE-2019-17572

In Apache RocketMQ 4.2.0 to 4.6.0, when the automatic topic creation in the broker is turned on by default, an evil topic like “../../../../topic2020” is sent from rocketmq-client to the broker, a topic folder will be created in the parent directory in brokers, which leads to a directory traversa...

Apache RocketMQ 4.2.0 < 4.6.1 Directory Traversal (CVE-2023-37582)

In Apache RocketMQ 4.2.0 to 4.6.0, when the automatic topic creation in the broker is turned on by default, an evil topic like ../../../../topic2020 is sent from rocketmq-client to the broker, a topic folder will be created in the parent directory in brokers, which leads to a directory traversal...

com.webank.defibus:defibus-broker (>=1.0.0, <=1.0.1), com.webank.defibus:defibus-namesrv (>=1.0.0, <=1.0.1) +1 more potentially affected by CVE-2019-17572 via org.apache.rocketmq:rocketmq-broker (>=4.2.0, <=4.6.0)

org.apache.rocketmq:rocketmq-broker MAVEN version =4.2.0, =1.0.0, =1.0.0, =4.2.0, =4.6.0 Source cves: CVE-2019-17572 Source advisory: GHSA-5X3V-2GXR-59M2...

com.webank.defibus:defibus-broker (>=1.0.0, <=1.0.1), com.webank.defibus:defibus-namesrv (>=1.0.0, <=1.0.1) +1 more potentially affected by CVE-2019-17572 via org.apache.rocketmq:rocketmq-broker (>=4.2.0, <=4.6.0)

org.apache.rocketmq:rocketmq-broker MAVEN version =4.2.0, =1.0.0, =1.0.0, =4.2.0, =4.6.0 Source cves: CVE-2019-17572 Source advisory: OSV:GHSA-5X3V-2GXR-59M2...

CVE-2019-17572

In Apache RocketMQ 4.2.0 to 4.6.0, when the automatic topic creation in the broker is turned on by default, an evil topic like “../../../../topic2020” is sent from rocketmq-client to the broker, a topic folder will be created in the parent directory in brokers, which leads to a directory traversa...

CVE-2019-17572

CVE-2019-17572 affects Apache RocketMQ from versions 4.2.0 through 4.6.0. When broker automatic topic creation is enabled by default, an attacker-provided topic such as “../../../../topic2020” can cause a directory to be created in the broker’s parent directory, resulting in a directory traversal...