CVE-2021-39231

Missing authentication/authorization on internal RPC endpoints

In Apache Ozone versions prior to 1.2.0, Various internal server-to-server RPC endpoints are available for connections, making it possible for an attacker to download raw data from Datanode and Ozone manager and modify Ratis replication configuration.

CVSS 3.1 · 9.1 Critical EPSS 2.4% KEV · Not listed

Vendors

Apache

Products

Ozone

CVE-2021-38555

An XML external entity (XXE) injection vulnerability exists in Apache Any23 StreamUtils.java

An XML external entity (XXE) injection vulnerability was discovered in the Any23 StreamUtils.java file and is known to affect Any23 versions < 2.5. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access.

CVSS 3.1 · 9.1 Critical EPSS 2.8% KEV · Not listed

Vendors

Apache

Products

Any23

CVE-2021-38540

Apache Airflow: Variable Import endpoint missed authentication check

The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclosure or remote code execution. This issue affects Apache Airflow >=2.0.0, <2.1.3.

CVSS 3.1 · 9.8 Critical EPSS 80.9% KEV · Not listed

Vendors

Apache

Products

Airflow

CVE-2021-38296

Apache Spark Key Negotiation Vulnerability

Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an initial interactive attack, this would allow someone to decrypt plaintext traffic offline. Note that this does not affect security mechanisms controlled by "spark.authenticate.enableSaslEncryption", "spark.io.encryption.enabled", "spark.ssl", "spark.ui.strictTransportSecurity". Update to Apache Spark 3.1.3 or later

CVSS 3.1 · 7.5 High EPSS 1.8% KEV · Not listed

Vendors

Apache Oracle

Products

Spark Financial Services Crime And Compliance Management Studio

CVE-2021-38295

Privilege escalation vulnerability when using HTML attachments

In Apache CouchDB, a malicious user with permission to create documents in a database is able to attach a HTML attachment to a document. If a CouchDB admin opens that attachment in a browser, e.g. via the CouchDB admin interface Fauxton, any JavaScript code embedded in that HTML attachment will be executed within the security context of that admin. A similar route is available with the already deprecated _show and _list functionality. This privilege escalation vulnerability allows an attacker to add or remove data in any database or make configuration changes. This issue affected Apache CouchDB prior to 3.1.2

CVSS 3.1 · 7.3 High EPSS 3.7% KEV · Not listed

Vendors

Apache

Products

Couchdb

CVE-2021-38294

Shell Command Injection Vulnerability in Nimbus Thrift Server

A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication.

CVSS 3.1 · 9.8 Critical EPSS 83.8% KEV · Not listed

Vendors

Apache

Products

Storm

CVE-2021-38161

Not validating origin TLS certificate

Improper Authentication vulnerability in TLS origin verification of Apache Traffic Server allows for man in the middle attacks. This issue affects Apache Traffic Server 8.0.0 to 8.0.8.

CVSS 3.1 · 8.1 High EPSS 1.9% KEV · Not listed

Vendors

Apache Debian

Products

Traffic Server Debian Linux

CVE-2021-37608

Arbitrary file upload vulnerability in OFBiz

Unrestricted Upload of File with Dangerous Type vulnerability in Apache OFBiz allows an attacker to execute remote commands. This issue affects Apache OFBiz version 17.12.07 and prior versions. Upgrade to at least 17.12.08 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12297.

CVSS 3.1 · 9.8 Critical EPSS 6.0% KEV · Not listed

Vendors

Apache

Products

Ofbiz

CVE-2021-37580

Apache ShenYu Admin bypass JWT authentication

A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. This issue affected Apache ShenYu 2.3.0 and 2.4.0

CVSS 3.1 · 9.8 Critical EPSS 40.8% KEV · Not listed

Vendors

Apache

Products

Shenyu

CVE-2021-37579

Bypass deserialization checks in Apache Dubbo

The Dubbo Provider will check the incoming request and the corresponding serialization type of this request meet the configuration set by the server. But there's an exception that the attacker can use to skip the security check (when enabled) and reaching a deserialization operation with native java serialization. Apache Dubbo 2.7.13, 3.0.2 fixed this issue by quickly fail when any unrecognized request was found.

CVSS 3.1 · 9.8 Critical EPSS 6.6% KEV · Not listed

Vendors

Apache

Products

Dubbo

CVE-2021-37578

Remote code execution via RMI

Apache jUDDI uses several classes related to Java's Remote Method Invocation (RMI) which (as an extension to UDDI) provides an alternate transport for accessing UDDI services. RMI uses the default Java serialization mechanism to pass parameters in RMI invocations. A remote attacker can send a malicious serialized object to the above RMI entries. The objects get deserialized without any check on the incoming data. In the worst case, it may let the attacker run arbitrary code remotely. For both jUDDI web service applications and jUDDI clients, the usage of RMI is disabled by default. Since this is an optional feature and an extension to the UDDI protocol, the likelihood of impact is low. Starting with 3.3.10, all RMI related code was removed.

CVSS 3.1 · 9.8 Critical EPSS 4.1% KEV · Not listed

Vendors

Apache

Products

Juddi

CVE-2021-37404

Heap buffer overflow in libhdfs native library

There is a potential heap buffer overflow in Apache Hadoop libhdfs native code. Opening a file path provided by user without validation may result in a denial of service or arbitrary code execution. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.

CVSS 3.1 · 9.8 Critical EPSS 3.1% KEV · Not listed

Vendors

Apache

Products

Hadoop

CVE-2021-37149

Request Smuggling - multiple attacks

Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.2 and 9.0.0 to 9.1.0.

CVSS 3.1 · 7.5 High EPSS 2.7% KEV · Not listed

Vendors

Apache Debian

Products

Traffic Server Debian Linux

CVE-2021-37148

Request Smuggling - transfer encoding validation

Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.2 and 9.0.0 to 9.0.1.

CVSS 3.1 · 7.5 High EPSS 2.7% KEV · Not listed

Vendors

Apache Debian

Products

Traffic Server Debian Linux

CVE-2021-37147

Request Smuggling - LF line ending

Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.2 and 9.0.0 to 9.1.0.

CVSS 3.1 · 7.5 High EPSS 2.5% KEV · Not listed

Vendors

Apache Debian

Products

Traffic Server Debian Linux

CVE-2021-36372

Original block tokens are persisted and can be retrieved

In Apache Ozone versions prior to 1.2.0, Initially generated block tokens are persisted to the metadata database and can be retrieved with authenticated users with permission to the key. Authenticated users may use them even after access is revoked.

CVSS 3.1 · 9.8 Critical EPSS 2.5% KEV · Not listed

Vendors

Apache

Products

Ozone

CVE-2021-36163

Unsafe deserialization in providers using the Hessian protocol

In Apache Dubbo, users may choose to use the Hessian protocol. The Hessian protocol is implemented on top of HTTP and passes the body of a POST request directly to a HessianSkeleton: New HessianSkeleton are created without any configuration of the serialization factory and therefore without applying the dubbo properties for applying allowed or blocked type lists. In addition, the generic service is always exposed and therefore attackers do not need to figure out a valid service/method name pair. This is fixed in 2.7.13, 2.6.10.1

CVSS 3.1 · 9.8 Critical EPSS 3.3% KEV · Not listed

Vendors

Apache

Products

Dubbo

CVE-2021-36162

Unprotected yaml deserialization cause RCE

Apache Dubbo supports various rules to support configuration override or traffic routing (called routing in Dubbo). These rules are loaded into the configuration center (eg: Zookeeper, Nacos, ...) and retrieved by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers will use SnakeYAML library to load the rules which by default will enable calling arbitrary constructors. An attacker with access to the configuration center he will be able to poison the rule so when retrieved by the consumers, it will get RCE on all of them. This was fixed in Dubbo 2.7.13, 3.0.2

CVSS 3.1 · 8.8 High EPSS 2.3% KEV · Not listed

Vendors

Apache

Products

Dubbo

CVE-2021-36161

Unprotected input value toString cause RCE

Some component in Dubbo will try to print the formated string of the input arguments, which will possibly cause RCE for a maliciously customized bean with special toString method. In the latest version, we fix the toString call in timeout, cache and some other places. Fixed in Apache Dubbo 2.7.13

CVSS 3.1 · 9.8 Critical EPSS 2.5% KEV · Not listed

Vendors

Apache

Products

Dubbo

CVE-2021-36152

Insecure TrustManager used in LDAP connections

Apache Gobblin trusts all certificates used for LDAP connections in Gobblin-as-a-Service. This affects versions <= 0.15.0. Users should update to version 0.16.0 which addresses this issue.

CVSS 3.1 · 9.8 Critical EPSS 1.3% KEV · Not listed

Vendors

Apache

Products

Gobblin