CVE-2017-7686 Apache Ignite communicates to an external PHP server where sensitive information is sent
HighCVSS 7.5
EPSS 3.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Apache Ignite 1.0.0-RC3 to 2.0 uses an update notifier component to update the users about new project releases that include additional functionality, bug fixes and performance improvements. To do that the component communicates to an external PHP server (http://ignite.run) where it needs to send some system properties like Apache Ignite or Java version. Some of the properties might contain user sensitive information.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.ignite/ignite-core(Maven) | < 2.1 | 2.1 |
| org.apache.ignite/ignite-core(Maven) | = 1.0.0 | No fix listed |
| org.apache.ignite/ignite-core(Maven) | = 1.0.0-RC1 | No fix listed |
| org.apache.ignite/ignite-core(Maven) | = 1.0.0-RC3 | No fix listed |
| org.apache.ignite/ignite-core(Maven) | = 1.1.0-incubating | No fix listed |
| org.apache.ignite/ignite-core(Maven) | = 1.2.0-incubating | No fix listed |
| org.apache.ignite/ignite-core(Maven) | = 1.3.0-incubating | No fix listed |
| org.apache.ignite/ignite-core(Maven) | = 1.4.0 | No fix listed |
| org.apache.ignite/ignite-core(Maven) | = 1.5.0-b1 | No fix listed |
| org.apache.ignite/ignite-core(Maven) | = 1.5.0.final | No fix listed |
| org.apache.ignite/ignite-core(Maven) | = 1.6.0 | No fix listed |
| org.apache.ignite/ignite-core(Maven) | = 1.7.0 | No fix listed |
| org.apache.ignite/ignite-core(Maven) | = 1.8.0 | No fix listed |
| org.apache.ignite/ignite-core(Maven) | = 1.9.0 | No fix listed |
| org.apache.ignite/ignite-core(Maven) | = 2.0.0 | No fix listed |
| apache ignite | = 1.0.0 | No fix listed |
| apache ignite | = 1.0.0-rc3 | No fix listed |
| apache ignite | = 1.1.0 | No fix listed |
| apache ignite | = 1.2.0 | No fix listed |
| apache ignite | = 1.3.0 | No fix listed |
| apache ignite | = 1.4.0 | No fix listed |
| apache ignite | = 1.5.0-b1 | No fix listed |
| apache ignite | = 1.5.0-final | No fix listed |
| apache ignite | = 1.6.0 | No fix listed |
| apache ignite | = 1.7.0 | No fix listed |
Show 4 more
| Product | Affected versions | Fixed in |
|---|---|---|
| apache ignite | = 1.8.0 | No fix listed |
| apache ignite | = 1.9.0 | No fix listed |
| apache ignite | = 2.0.0 | No fix listed |
| Apache Ignite | = 1.0.0-RC3 to 2.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com vendor-advisory
- apache-ignite-developers.2346864.n4.nabble.com mitigation third-party-advisory
- 99292 third-party-advisory vdb-entry