Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

io.prestosql:presto-server

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.4MavenPublished

    Privilege escalation in Presto

    CVE-2020-15087 · GHSA-f6pc-crhh-cp96

    Affected
    • Maven io.prestosql:presto-server < 337
    Fixed in
    337· Vendor fix available
    Issue
    Affected This affects Presto server installations. This does NOT affect clients such as the CLI or JDBC driver. Impact Authenticated users can bypass authorization checks by directly accessing internal APIs. This impacts Presto server installations with secure internal communication configured. This does not affect installations that have not configured secure internal communication, as these installations are inherently insecure. Patches This issue has been fixed starting with PrestoSQL version 337. Workarounds This issue can be mitigated by blocking network access to internal APIs on the coordinator and workers. References See the Presto documentation for Secure Internal Communication. For more information If you have any questions or comments about this advisory: Join the #security channel on Slack. Contact the security team at security@trino.io

    Recommended action: Upgrade to 337 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →