QID 981000

QID 981000: Java (maven) Security Update for org.rundeck:rundeck (GHSA-5679-7qrc-5m7j)

Security update has been released for org.rundeck:rundeck to fix the vulnerability.

Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.

Authenticated users can craft a request that reveals Execution data and logs and Job details that they are not authorized to see.

> Depending on the configuration and the way that Rundeck is used, this could result in anything between a high severity risk, or a very low risk. If access is tightly restricted and all users on the system have access to all projects, this is not really much of an issue. If access is wider and allows login for users that do not have access to any projects, or project access is restricted, there is a larger issue. If access is meant to be restricted and secrets, sensitive data, or intellectual property are exposed in Rundeck execution output and job data, the risk becomes much higher.

CVSS V3 rated as High - 6.5 severity.

CVSS V2 rated as Medium - 4 severity.

Solution

Upgrade to Rundeck version 3.2.6Workaround:
None

Vendor References

GHSA-5679-7qrc-5m7j - github.com/advisories/GHSA-5679-7qrc-5m7j

CVEs related to QID 981000

CVE-2020-11009 |

Software Advisories

Advisory ID	Software	Component	Link
GHSA-5679-7qrc-5m7j	org.rundeck:rundeck		github.com/advisories/GHSA-5679-7qrc-5m7j

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].