Apache Geode cluster information disclosure vulnerability

Apache Geode cluster is the Apache Software Foundation's platform for providing real-time and consistent access to data for data-intensive applications in distributed cloud architectures. A security vulnerability exists in Apache Geode cluster versions prior to 1.2.1. A remote attacker could...

Information Disclosure And Denial Of Service (DoS)

Apache Geode is vulnerable to information disclosure and denial of service DoS attacks. These attacks are possible when performing operations in secure mode. The application allows an unauthenticated user to use the multi-user authentication mode to send internal messages. This can lead to...

CVE-2017-9797

When an Apache Geode cluster before v1.2.1 is operating in secure mode, an unauthenticated client can enter multi-user authentication mode and send metadata messages. These metadata operations could leak information about application data types. In addition, an attacker could perform a denial of...

CVE-2017-9797

When an Apache Geode cluster before v1.2.1 is operating in secure mode, an unauthenticated client can enter multi-user authentication mode and send metadata messages. These metadata operations could leak information about application data types. In addition, an attacker could perform a denial of...

Information disclosure

When an Apache Geode cluster before v1.2.1 is operating in secure mode, an unauthenticated client can enter multi-user authentication mode and send metadata messages. These metadata operations could leak information about application data types. In addition, an attacker could perform a denial of...

CVE-2017-9797: Exposure of Sensitive Information to an Unauthorized Actor

When an Apache Geode cluster before v1.2.1 is operating in secure mode, an unauthenticated client can enter multi-user authentication mode and send metadata messages. These metadata operations could leak information about application data types. In addition, an attacker could perform a denial of...

com.lightbend.akka:akka-stream-alpakka-geode_2.11 (>=0.10, <=0.13), com.lightbend.akka:akka-stream-alpakka-geode_2.12 (>=0.10, <=0.13) +12 more potentially affected by CVE-2017-9797 via org.apache.geode:geode-core (>=1.0.0-incubating, <=1.2.0)

org.apache.geode:geode-core MAVEN version =1.0.0-incubating, =0.10, =0.10, =0.3.12, =0.3.5, =0.1.9, =1.0.0-incubating, =1.0.0-incubating, =1.0.0-incubating, =1.0.0-incubating, =1.0.0-incubating, =1.0.0-incubating, =0.9.0, =0.10.1 - org.springframework.data:spring-data-geode 1.0.0.incubating-relea...

CVE-2017-9797

The vulnerability CVE-2017-9797 affects Apache Geode clusters running versions prior to 1.2.1 in secure mode. An unauthenticated client can enter multi-user authentication mode and send metadata messages, which can disclose information about application data types and enable a denial-of-service a...

CVE-2017-9797

When an Apache Geode cluster before v1.2.1 is operating in secure mode, an unauthenticated client can enter multi-user authentication mode and send metadata messages. These metadata operations could leak information about application data types. In addition, an attacker could perform a denial of...

CVE-2017-9797

When an Apache Geode cluster before v1.2.1 is operating in secure mode, an unauthenticated client can enter multi-user authentication mode and send metadata messages. These metadata operations could leak information about application data types. In addition, an attacker could perform a denial of...

Information Disclosure

geode-core is vulnerable to information disclosure. The library has a bug in the gfsh query pagination, causing gfsh queries to return sensitive information from a different user...

PT-2017-19192

Name of the Vulnerable Software and Affected Versions Apache Geode versions prior to 1.2.1 Description The issue allows an unauthenticated client to enter multi-user authentication mode and send metadata messages when the cluster is operating in secure mode. This could lead to information leakage...

CVE-2017-9794

When a cluster is operating in secure mode, a user with read privileges for specific data regions can use the gfsh command line utility to execute queries. In Apache Geode before 1.2.1, the query results may contain data from another user's concurrently executing gfsh query, potentially revealing...

CVE-2017-9794

When a cluster is operating in secure mode, a user with read privileges for specific data regions can use the gfsh command line utility to execute queries. In Apache Geode before 1.2.1, the query results may contain data from another user's concurrently executing gfsh query, potentially revealing...

Command injection

When a cluster is operating in secure mode, a user with read privileges for specific data regions can use the gfsh command line utility to execute queries. In Apache Geode before 1.2.1, the query results may contain data from another user's concurrently executing gfsh query, potentially revealing...

CVE-2017-9794: Exposure of Sensitive Information to an Unauthorized Actor

When a cluster is operating in secure mode, a user with read privileges for specific data regions can use the gfsh command line utility to execute queries. In Apache Geode before 1.2.1, the query results may contain data from another user's concurrently executing gfsh query, potentially revealing...

CVE-2017-9794

The CVE-2017-9794 entry describes an information-disclosure flaw in Apache Geode prior to version 1.2.1: when a cluster runs in secure mode, a user with read access to certain data regions can use the gfsh CLI to run queries, and query results may include data from another user’s concurrent gfsh ...

CVE-2017-9794

When a cluster is operating in secure mode, a user with read privileges for specific data regions can use the gfsh command line utility to execute queries. In Apache Geode before 1.2.1, the query results may contain data from another user's concurrently executing gfsh query, potentially revealing...

com.lightbend.akka:akka-stream-alpakka-geode_2.11 (>=0.10, <=0.13), com.lightbend.akka:akka-stream-alpakka-geode_2.12 (>=0.10, <=0.13) +12 more potentially affected by CVE-2017-9794 via org.apache.geode:geode-core (>=1.0.0-incubating, <=1.2.0)

org.apache.geode:geode-core MAVEN version =1.0.0-incubating, =0.10, =0.10, =0.3.12, =0.3.5, =0.1.9, =1.0.0-incubating, =1.0.0-incubating, =1.0.0-incubating, =1.0.0-incubating, =1.0.0-incubating, =1.0.0-incubating, =0.9.0, =0.10.1 - org.springframework.data:spring-data-geode 1.0.0.incubating-relea...

PT-2017-19191

Name of the Vulnerable Software and Affected Versions Apache Geode versions prior to 1.2.1 Description The issue allows a user with read privileges for specific data regions to potentially view unauthorized data when executing queries using the gfsh command line utility in secure mode. This can...