SB2020102845 - Multiple vulnerabilities in Primavera Unifier
Published: October 28, 2020
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 secuirty vulnerabilities.
1) Improper Certificate Validation (CVE-ID: CVE-2020-9488)
The vulnerability allows a remote attacker to perform man-in-the-middle attack.
The vulnerability exists due to the Apache Log4j SMTP appender does not validate SSL certificates. A remote attacker can perform a MitM attack, intercept and decrypt network traffic.
2) Memory leak (CVE-ID: CVE-2020-9489)
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also cause out of memory errors and/or infinite loops in Tika's ICNSParser, MP3Parser, MP4Parser, SAS7BDATParser, OneNoteParser and ImageParser. Apache Tika users should upgrade to 1.24.1 or later. The vulnerabilities in the MP4Parser were partially fixed by upgrading the com.googlecode:isoparser:1.1.22 dependency to org.tallison:isoparser:1.9.41.2. For unrelated security reasons, we upgraded org.apache.cxf to 3.3.6 as part of the 1.24.1 release.
3) Improper access control (CVE-ID: CVE-2018-17196)
The vulnerability allows a remote attacker to gain unauthorized access to sensitive information.
The vulnerability exists due to improper security restrictions imposed by the affected software. A remote authenticated attacker with write permission on respective topics can send a crafted Produce request that is designed to bypass transaction/idempotent access control list (ACL) validation.
4) Code Injection (CVE-ID: CVE-2019-17558)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation in VelocityResponseWriter, when "params.resource.loader.enabled" is set to true in Apache Solr configuration. A remote authenticated user with ability to load templates or change software configuration can inject a malicious template and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
5) XML External Entity injection (CVE-ID: CVE-2017-9096)
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
The XML parsers in iText before 5.5.12 and 7.x before 7.0.3 do not disable external entities, which might allow remote attackers to conduct XML external entity (XXE) attacks via a crafted PDF.
6) XXE attack (CVE-ID: CVE-2015-1832)
The vulnerability allows a remote user to conduct XXE attack.The weakness exists due to XML external entity error. Via vectors involving XmlVTI and the XML datatype context-dependent attackers can view arbitrary files that may lead to denial of service.
Successful exploitation of the vulnerability can result in potentially sensitive information disclosure and denial of service on the vulnerable system.
Remediation
Install update from vendor's website.