Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:maven/org.apache.rocketmq/rocketmq-broker@5.1.2
Typemaven
Namespaceorg.apache.rocketmq
Namerocketmq-broker
Version5.1.2
Qualifiers
Subpath
Is_vulnerablefalse
Next_non_vulnerable_versionnull
Latest_non_vulnerable_versionnull
Affected_by_vulnerabilities
Fixing_vulnerabilities
0
url VCID-jk3w-dds4-qbhw
vulnerability_id VCID-jk3w-dds4-qbhw
summary 
RocketMQ NameServer component Code Injection vulnerability
The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 5.1.1.

When NameServer address are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function on the NameServer component to execute commands as the system users that RocketMQ is running as.

It is recommended for users to upgrade their NameServer version to 5.1.2 or above for RocketMQ 5.x or 4.9.7 or above for RocketMQ 4.x to prevent these attacks.
references
0
reference_url https://github.com/apache/rocketmq
reference_id
reference_type
scores
url https://github.com/apache/rocketmq
1
reference_url https://lists.apache.org/thread/m614czxtpvlztd7mfgcs2xcsg36rdbnc
reference_id
reference_type
scores
url https://lists.apache.org/thread/m614czxtpvlztd7mfgcs2xcsg36rdbnc
2
reference_url http://www.openwall.com/lists/oss-security/2023/07/12/1
reference_id
reference_type
scores
url http://www.openwall.com/lists/oss-security/2023/07/12/1
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-37582
reference_id CVE-2023-37582
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2023-37582
4
reference_url https://github.com/advisories/GHSA-gpq8-963w-8qc9
reference_id GHSA-gpq8-963w-8qc9
reference_type
scores
url https://github.com/advisories/GHSA-gpq8-963w-8qc9
fixed_packages
0
url pkg:maven/org.apache.rocketmq/rocketmq-broker@4.9.7
purl pkg:maven/org.apache.rocketmq/rocketmq-broker@4.9.7
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.rocketmq/rocketmq-broker@4.9.7
1
url pkg:maven/org.apache.rocketmq/rocketmq-broker@5.1.2
purl pkg:maven/org.apache.rocketmq/rocketmq-broker@5.1.2
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.rocketmq/rocketmq-broker@5.1.2
aliases CVE-2023-37582, GHSA-gpq8-963w-8qc9
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-jk3w-dds4-qbhw
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:maven/org.apache.rocketmq/rocketmq-broker@5.1.2