Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2021:0447-1

Опубликовано: 19 мар. 2021
Источник: suse-cvrf

Описание

Security update for velocity

This update for velocity fixes the following issues:

  • CVE-2020-13936: Fixed an arbitrary code execution when attacker is able to modify templates (bsc#1183360).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

Список пакетов

openSUSE Leap 15.2
velocity-1.7-lp152.5.3.1
velocity-demo-1.7-lp152.5.3.1
velocity-javadoc-1.7-lp152.5.3.1
velocity-manual-1.7-lp152.5.3.1

Ссылки

Описание

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.

Затронутые продукты
openSUSE Leap 15.2:velocity-1.7-lp152.5.3.1
openSUSE Leap 15.2:velocity-demo-1.7-lp152.5.3.1
openSUSE Leap 15.2:velocity-javadoc-1.7-lp152.5.3.1
openSUSE Leap 15.2:velocity-manual-1.7-lp152.5.3.1
Ссылки