Homepage
About Snyk

org.graylog2:graylog2-server@0.20.0-rc.1-1 vulnerabilities

  • latest version

    6.1.1

  • latest non vulnerable version

    6.0.7

  • first published

    11 years ago

  • latest version published

    a month ago

  • licenses detected

  • package manager

    View on Maven Repository
Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the org.graylog2:graylog2-server package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Insecure Randomness

org.graylog2:graylog2-server is a log management platform.

Affected versions of this package are vulnerable to Insecure Randomness such that an external attacker could inject forged DNS responses into a Graylog's lookup table cache. Graylog seems to bind a single socket for outgoing DNS queries. That socket is bound to a random port number which is not changed again.

How to fix Insecure Randomness?

Upgrade org.graylog2:graylog2-server to version 5.0.9, 5.1.3 or higher.

[,5.0.9) [5.1.0,5.1.3)
  • M
Directory Traversal

org.graylog2:graylog2-server is a log management platform.

Affected versions of this package are vulnerable to Directory Traversal. When starting Graylog with the JVM -cp classpath options, instead of using the default -jar for the bundled classes, the API REST endpoint /api-browser/.* would allow path traversal to allow reading files on the server's filesystem.

For example, when starting graylog-server like:

/usr/local/openjdk-8/bin/java -XX:+UnlockExperimentalVMOptions -XX:+UseCGroupMemoryLimitForHeap -XX:NewRatio=1 -XX:MaxMetaspaceSize=256m -server -XX:+ResizeTLAB -XX:+UseConcMarkSweepGC -XX:+CMSConcurrentMTEnabled -XX:+CMSClassUnloadingEnabled -XX:+UseParNewGC -XX:-OmitStackTraceInFastThrow -cp /usr/share/graylog:/usr/share/graylog/graylog.jar -Dlog4j.configurationFile=/usr/share/graylog/data/config/log4j2.xml -Djava.library.path=/usr/share/graylog/lib/sigar/ -Dgraylog2.installation_source=docker org.graylog2.bootstrap.Main server -f /usr/share/graylog/data/config/graylog.conf

The use of -cp /usr/share/graylog:/usr/share/graylog/graylog.jar triggers the vulnerability.

The check for .. elements in the resulting file path for documentation resources is performed too early in the resolution process. As a result, an attacker can craft a URL that can contain .. elements and thus read files the server process has access to.

Note: This vulnerability does not apply to the standard installation methods.

How to fix Directory Traversal?

Upgrade org.graylog2:graylog2-server to version 4.0.0-beta.1 or higher.

[0,4.0.0-beta.1)
  • H
Improper Certificate Validation

org.graylog2:graylog2-server is a log management platform.

Affected versions of this package are vulnerable to Improper Certificate Validation. It accepts LDAP server certificates whose root certificate is not in any trust store. This presents a vulnerability for man-in-the-middle attacks.

How to fix Improper Certificate Validation?

Upgrade org.graylog2:graylog2-server to version 3.3.3 or higher.

[0,3.3.3)
  • M
Cross-site Scripting (XSS)

org.graylog2:graylog2-server is an open source log management.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) attacks due to not escaping text in notifications.

How to fix Cross-site Scripting (XSS)?

Upgrade org.graylog2:graylog2-server to version 2.4.4 or higher.

[,2.4.4)
  • M
Cross-site Scripting (XSS)

org.graylog2:graylog2-server is an open source log management.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) attacks due to unescaped text in dashboard names.

How to fix Cross-site Scripting (XSS)?

Upgrade org.graylog2:graylog2-server to version 2.4.4 or higher.

[,2.4.4)
Go back to all versions of this package