Apache Geode vulnerable to Exposure of Sensitive Information
Moderate severity
GitHub Reviewed
Published
May 13, 2022
to the GitHub Advisory Database
•
Updated Jan 29, 2023
Package
Affected versions
>= 1.0.0, < 1.2.1
Patched versions
1.2.1
Description
Published by the National Vulnerability Database
Oct 3, 2017
Published to the GitHub Advisory Database
May 13, 2022
Reviewed
Nov 8, 2022
Last updated
Jan 29, 2023
When an Apache Geode cluster before v1.2.1 is operating in secure mode, an unauthenticated client can enter multi-user authentication mode and send metadata messages. These metadata operations could leak information about application data types. In addition, an attacker could perform a denial of service attack on the cluster.
References