CVE-2014-3582: Code Injection
Published Mar 29, 2017
·Updated
In Ambari 1.2.0 through 2.2.2, it may be possible to execute arbitrary system commands on the Ambari Server host while generating SSL certificates for hosts in an Ambari cluster.
Affected Software
1 affected component
Apache Ambari<=2.2.2
Event History
Mar 29, 2017
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-3582?
CVE-2014-3582 has a medium severity rating due to its potential for arbitrary command execution.
2
How do I fix CVE-2014-3582?
To fix CVE-2014-3582, upgrade Apache Ambari to version 2.4.0 or later.
3
What versions of Apache Ambari are affected by CVE-2014-3582?
CVE-2014-3582 affects Apache Ambari versions from 1.2.0 to 2.2.2.
4
What could happen if CVE-2014-3582 is exploited?
Exploiting CVE-2014-3582 could allow an attacker to execute arbitrary system commands on the Ambari Server host.
5
Is there a workaround for CVE-2014-3582?
There isn't a specific workaround for CVE-2014-3582; upgrading to a safe version is recommended.