Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Component: io.crate.protocols.http.HttpBlobHandler Affected: verified against CrateDB 6.2.7 (latest at time of report; the bug has existed since the blob HTTP handler was introduced) Impact: any authenticated user can read or delete any blob whose SHA-1 digest they know, and can plant new blobs unconditionally, in any blob table, regardless of GRANTs. --- Summary CrateDB has two ways to access blob storage: SQL (SELECT ... FROM blob.<table and friends) and the blob HTTP API (GET|PUT|DELETE /blobs/{table}/{digest}). The SQL path goes through AccessControl, which is what enforces privilege grants; that's why SELECT digest FROM blob.secretblobs fails for a user who has no grants on the table. The HTTP path authenticates the request but never asks AccessControl whether the authenticated user is allowed to touch the table. So a user with no grants gets MissingPrivilegeException from SQL and 200 OK plus the blob bytes from GET /blobs/secretblobs/<digest. Where it lives…
Recommended action: Upgrade to 6.3.2 or 6.2.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Client-Initiated TLS Renegotiation Denial of Service (DoS) Vulnerability at Port 4200 Details A high-risk vulnerability has been identified where the TLS endpoint (port 4200) permits client-initiated renegotiation. In this scenario, an attacker can exploit this feature to repeatedly request renegotiation of security parameters during an ongoing TLS session. This flaw could lead to excessive consumption of CPU resources, resulting in potential server overload and service disruption. The vulnerability was confirmed using an openssl client where the command 'R' initiates renegotiation, followed by the server confirming with 'RENEGOTIATING'. PoC 1. Connect to the TLS server on port 4200 using an openssl client. 2. Initiate a TLS session. 3. Send the renegotiation command ('R') multiple times. 4. Observe the server response to confirm renegotiation. Impact This vulnerability allows an attacker to perform a denial of service attack by exhausting server CPU resources through…
Recommended action: Upgrade to 5.7.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
There is an arbitrary file read vulnerability in the CrateDB database, and authenticated CrateDB database users can read any file on the system. Details There is a COPY FROM function in the CrateDB database that is used to import file data into database tables. This function has a flaw, and authenticated attackers can use the COPY FROM function to import arbitrary file content into database tables, resulting in information leakage. PoC Impact This vulnerability affects all current versions of the CrateDB database. Attackers who exploit this vulnerability to obtain sensitive information may carry out further attacks, while also affecting CrateDB Cloud Clusters.
Recommended action: Upgrade to 5.6.1, 5.5.4, 5.4.8 or 5.3.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
CrateDB 5.5.1 is contains an authentication bypass vulnerability in the Admin UI component. After configuring password authentication and Local In the case of an address, identity authentication can be bypassed by setting the X-Real IP request header to a specific value and accessing the Admin UI directly using the default user identity.
Recommended action: Upgrade to 5.5.2, 5.4.7, 5.3.8 or 5.2.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.