Описание
Missing permission checks on Hazelcast client protocol
Impact
In Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 through 5.1.7, 5.2 through 5.2.4, and 5.3 through 5.3.2, some client operations don't check permissions properly, allowing authenticated users to access data stored in the cluster.
Patches
Fix versions: 5.2.5, 5.3.5, 5.4.0-BETA-1
Workarounds
There is no known workaround.
Пакеты
com.hazelcast:hazelcast
<= 4.1.10
Отсутствует
com.hazelcast:hazelcast
>= 4.2, <= 4.2.8
Отсутствует
com.hazelcast:hazelcast
>= 5.0, <= 5.0.5
Отсутствует
com.hazelcast:hazelcast
>= 5.1, <= 5.1.7
Отсутствует
com.hazelcast:hazelcast
>= 5.2.0, <= 5.2.4
5.2.5
com.hazelcast:hazelcast
>= 5.3.0, < 5.3.5
5.3.5
com.hazelcast:hazelcast-all
<= 4.1.10
Отсутствует
com.hazelcast:hazelcast-all
>= 4.2, <= 4.2.8
Отсутствует
Связанные уязвимости
In Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 through 5.1.7, 5.2 through 5.2.4, and 5.3 through 5.3.2, some client operations don't check permissions properly, allowing authenticated users to access data stored in the cluster.
In Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 ...