An open API service providing security vulnerability metadata for many open source software ecosystems.
| Affected Packages | Affected Versions | Fixed Versions | |
|---|---|---|---|
| maven:org.apache.zeppelin:zeppelin-server | >= 0.10.1, < 0.12.0 | 0.12.0 | |
Affected Version RangesAll affected versions0.10.1, 0.11.0, 0.11.1, 0.11.2 All unaffected versions0.6.0, 0.6.1, 0.6.2, 0.7.0, 0.7.1, 0.7.2, 0.7.3, 0.8.0, 0.8.1, 0.8.2, 0.9.0, 0.10.0, 0.12.0 |
|||
| maven:org.apache.zeppelin:zeppelin-interpreter | >= 0.10.1, < 0.12.0 | 0.12.0 | |
Affected Version RangesAll affected versions0.10.1, 0.11.0, 0.11.1, 0.11.2 All unaffected versions0.6.0, 0.6.1, 0.6.2, 0.7.0, 0.7.1, 0.7.2, 0.7.3, 0.8.0, 0.8.1, 0.8.2, 0.9.0, 0.10.0, 0.12.0 |
|||
The attacker can use the raft server protocol in an unauthenticated way. The attacker can see the server's resources, including directories and files.
This issue affects Apache Zeppelin: from 0.10.1 up to 0.12.0.
Users are recommended to upgrade to version 0.12.0, which fixes the issue by removing the Cluster Interpreter.
References: