io.kamon:kamon-opentsdb_2.10 (=0.6.7), io.kamon:kamon-opentsdb_2.11 (=0.6.7) +1 more potentially affected by CVE-2018-12972 via net.opentsdb:opentsdb (=2.3.0)

net.opentsdb:opentsdb MAVEN version =2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on net.opentsdb:opentsdb and may be impacted: - io.kamon:kamon-opentsdb2.10 =0.6.7 - io.kamon:kamon-opentsdb2.11 =0.6.7 - io.kamon:kamon-opentsdb2.12 =0.6.7 Source...

CVE-2018-12972

OpenTSDB 2.3.0 is affected by CVE-2018-12972. The /q endpoint accepts many parameters (o, key, style, yrange, y2range, and their JSON input) that can be used to execute arbitrary commands, enabling remote code execution. Public advisories (GHSA-CX2V-JRJC-G54W and OSV/Veracode entries) describe th...