Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

net.opentsdb:opentsdb

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.8MavenPublished

    Remote Code Execution for 2.4.1 and earlier

    CVE-2023-36812 · GHSA-76f7-9v52-v2fw

    Affected
    • Maven net.opentsdb:opentsdb <= 2.4.1
    Fixed in
    2.4.2· Vendor fix available
    Issue
    Impact OpenTSDB is vulnerable to Remote Code Execution vulnerability by writing user-controlled input to Gnuplot configuration file and running Gnuplot with the generated configuration. Patches Patched in 07c4641471c6f5c2ab5aab615969e97211eb50d9 and further refined in https://github.com/OpenTSDB/opentsdb/commit/fa88d3e4b5369f9fb73da384fab0b23e246309ba Workarounds Disable Gunuplot via tsd.core.enableui = true and remove the shell files https://github.com/OpenTSDB/opentsdb/blob/master/src/mygnuplot.bat and https://github.com/OpenTSDB/opentsdb/blob/master/src/mygnuplot.sh.

    Recommended action: Upgrade to 2.4.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →