Description
When an Apache Geode server versions 1.0.0 to 1.8.0 is operating in secure mode, a user with write permissions for specific data regions can modify internal cluster metadata. A malicious user could modify this data in a way that affects the operation of the cluster.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Apache Geode | Apache Geode 1.0.0 to 1.8.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.geode:geode-core | < 1.9.0 | 1.9.0 | GHSA-p426-qw2p-v95v |