MGASA-2021-0183

See a problem?
Please try reporting it to the source first.

Source

https://advisories.mageia.org/MGASA-2021-0183.html

Import Source

https://advisories.mageia.org/MGASA-2021-0183.json

JSON Data

https://api.osv.dev/v1/vulns/MGASA-2021-0183

Related

CVE-2020-13936

Published

2021-04-12T19:59:59Z

Modified

2021-04-12T18:57:53Z

Summary

Updated velocity packages fix security vulnerability

Details

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2 (CVE-2020-13936).

References

Credits

- Mageia - COORDINATOR
- - https://wiki.mageia.org/en/Packages_Security_Team

Affected packages

Mageia:8 / velocity

Package

Name: velocity
Purl: pkg:rpm/mageia/velocity?distro=mageia-8

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.7-33.1.mga8

Ecosystem specific

{
    "section": "core"
}

Mageia:7 / velocity

Package

Name: velocity
Purl: pkg:rpm/mageia/velocity?distro=mageia-7

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.7-22.1.mga7

Ecosystem specific

{
    "section": "core"
}