Description
Apache Ignite before 1.9 allows man-in-the-middle attackers to read arbitrary files via XXE in modified update-notifier documents.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.ignite:ignite-core | < 1.9 | 1.9 | GHSA-8qfc-cvjp-mgpq |
References
- 97509 vdb-entry
- http://seclists.org/oss-sec/2017/q2/31