https://seclists.org/oss-sec/2024/q2/276: CVE-2024-36471: Apache Allura: sensitive information exposuvia DNS binding
Published Jun 10, 2024
·Updated
Affected Software
1 affected component
Apache Allura>=1.0.1<=1.16.0
Frequently Asked Questions
1
Who can exploit this issue?
A project administrator must be able to run an import. Exploitation relies on a DNS rebinding attack between URL verification and URL processing.
2
What systems or data could be exposed?
A successful exploit could cause Allura to read from internal services and expose their information.
3
Which deployments are affected?
Apache Allura versions 1.0.1 through 1.16.0 are affected. Version 1.17.0 fixes the issue.
4
What can be done if upgrading is not immediately possible?
Set "disable_entry_points.allura.importers = forge-tracker, forge-discussion" in the Allura .ini configuration file.