CVE-2016-8746 Apache Ranger policy engine incorrectly matches paths in certain conditions
MediumCVSS 5.9
EPSS 2.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Apache Ranger before 0.6.3 policy engine incorrectly matches paths in certain conditions when policy does not contain wildcards and has recursion flag set to true.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.ranger/ranger-plugins-common(Maven) | < 0.6.3 | 0.6.3 |
| org.apache.ranger/ranger-plugins-common(Maven) | = 0.6.0 | No fix listed |
| org.apache.ranger/ranger-plugins-common(Maven) | = 0.6.1 | No fix listed |
| org.apache.ranger/ranger-plugins-common(Maven) | = 0.6.2 | No fix listed |
| apache ranger | <= 0.6.2 | No fix listed |
| Apache Ranger | = 0.6.0 - 0.6.2 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- cwiki.apache.org release-notes vendor-advisory
- github.com vendor-advisory
- 95998 third-party-advisory vdb-entry
- github.com patch