org.apache.iotdb:node-commons 2.0.7

Direct Vulnerabilities

Known vulnerabilities in the org.apache.iotdb:node-commons package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Directory Traversal Affected versions of this package are vulnerable to Directory Traversal in the `updateWritingFileIfNeeded()` method of `IoTDBFileReceiver`, which builds the write target as `new File(receiverFileDirWithIdSuffix.get(), fileName)` from the incoming pipe transfer `fileName` without confining it to the receiver directory. An attacker can write arbitrary files anywhere the IoTDB process has write permission by sending a pipe file transfer whose `fileName` contains `..` sequences that escape the intended receiver directory. Exploitation requires the ability to send to the pipe file receiver, and the writes are bounded by the file system permissions of the IoTDB process. How to fix Directory Traversal? Upgrade `org.apache.iotdb:node-commons` to version 2.0.10 or higher.	[1.0.0,2.0.10)
H Directory Traversal Affected versions of this package are vulnerable to Directory Traversal in the DataNode internal RPC interface for creating Trigger instances, which builds a file path from the uploaded Trigger JAR name without sufficient validation. An attacker can write arbitrary files with the permissions of the IoTDB process by placing path traversal sequences in the JAR name, causing files to be written outside the intended Trigger installation directory. Exploitation requires the internal DataNode RPC port to be reachable from an untrusted network, so deployments that keep that port on a trusted internal network are not exposed. How to fix Directory Traversal? Upgrade `org.apache.iotdb:node-commons` to version 2.0.8 or higher.	[1.3.3,2.0.8)

Vulnerability

Vulnerable Version

Directory Traversal

Affected versions of this package are vulnerable to Directory Traversal in the updateWritingFileIfNeeded() method of IoTDBFileReceiver, which builds the write target as new File(receiverFileDirWithIdSuffix.get(), fileName) from the incoming pipe transfer fileName without confining it to the receiver directory. An attacker can write arbitrary files anywhere the IoTDB process has write permission by sending a pipe file transfer whose fileName contains .. sequences that escape the intended receiver directory. Exploitation requires the ability to send to the pipe file receiver, and the writes are bounded by the file system permissions of the IoTDB process.

How to fix Directory Traversal?

Upgrade org.apache.iotdb:node-commons to version 2.0.10 or higher.

[1.0.0,2.0.10)

Directory Traversal

Affected versions of this package are vulnerable to Directory Traversal in the DataNode internal RPC interface for creating Trigger instances, which builds a file path from the uploaded Trigger JAR name without sufficient validation. An attacker can write arbitrary files with the permissions of the IoTDB process by placing path traversal sequences in the JAR name, causing files to be written outside the intended Trigger installation directory. Exploitation requires the internal DataNode RPC port to be reachable from an untrusted network, so deployments that keep that port on a trusted internal network are not exposed.

How to fix Directory Traversal?

Upgrade org.apache.iotdb:node-commons to version 2.0.8 or higher.

[1.3.3,2.0.8)

org.apache.iotdb:node-commons@2.0.7

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically