CVE-2021-27738

描述

All request mappings in `StreamingCoordinatorController.java` handling `/kylin/api/streaming_coordinator/*` REST API endpoints did not include any security checks, which allowed an unauthenticated user to issue arbitrary requests, such as assigning/unassigning of streaming cubes, creation/modification and deletion of replica sets, to the Kylin Coordinator. For endpoints accepting node details in HTTP message body, unauthenticated (but limited) server-side request forgery (SSRF) can be achieved. This issue affects Apache Kylin Apache Kylin 3 versions prior to 3.1.2.

如何修補 CVE-2021-27738

要修補 CVE-2021-27738,請將受影響套件升級到下列已修補版本。

• —升級至 3.1.3 或更新版本

CVE-2021-27738 正在被利用嗎?

低 — EPSS 為 2.6%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 3.1.3

參考連結(5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-27738
• PATCHgithub.com/apache/kylin
• WEBwww.openwall.com/lists/oss-security/2022/01/06/6
• WEBgithub.com/apache/kylin/pull/1646
• WEBlists.apache.org