www.bleepingcomputer.com
Open in
urlscan Pro
172.67.2.229
Public Scan
URL:
https://www.bleepingcomputer.com/news/security/apache-warns-of-critical-flaws-in-mina-hugegraph-traffic-control/
Submission: On December 27 via api from TR — Scanned from DE
Submission: On December 27 via api from TR — Scanned from DE
Form analysis 4 forms found in the DOM
https://www.bleepingcomputer.com/search/
<form title="Search site" action="https://www.bleepingcomputer.com/search/">
<input type="hidden" name="cx" value="partner-pub-0920899300397823:3529943228">
<input type="hidden" name="cof" value="FORID:10">
<input type="hidden" name="ie" value="UTF-8">
<input type="search" name="q" aria-label="Search Site" placeholder="Search Site">
</form>https://www.bleepingcomputer.com/search/
<form action="https://www.bleepingcomputer.com/search/">
<input type="hidden" name="cx" value="partner-pub-0920899300397823:3529943228">
<input type="hidden" name="cof" value="FORID:10">
<input type="hidden" name="ie" value="UTF-8">
<input type="search" name="q" aria-label="Search Site" placeholder="Search Site">
</form>POST https://www.bleepingcomputer.com/forums/index.php?app=core&module=global§ion=login&do=process&return=https://www.bleepingcomputer.com/news/security/apache-warns-of-critical-flaws-in-mina-hugegraph-traffic-control/
<form action="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=login&do=process&return=https://www.bleepingcomputer.com/news/security/apache-warns-of-critical-flaws-in-mina-hugegraph-traffic-control/"
method="post">
<div class="bc_form_feild">
<label for="ips_username">Username</label>
<input aria-label="Enter login name" title="Enter login name" type="text" id="ips_username" name="ips_username" spellcheck="false" autocomplete="username">
</div>
<div class="bc_form_feild">
<label for="ips_password">Password</label>
<input aria-label="Enter login password" title="Enter login passwod" type="password" id="ips_password" name="ips_password" spellcheck="false" autocomplete="current-password">
</div>
<div class="bc_form_feild">
<div class="bc_remember">
<input id="remember" type="checkbox" name="rememberMe" value="1" checked="checked">
<label for="remember">Remember Me</label>
</div>
<div class="bc_anon">
<input id="anonymous" type="checkbox" name="anonymous" value="1">
<label for="anonymous">Sign in anonymously</label>
</div>
</div>
<div class="bc_btn_wrap">
<input type="hidden" name="auth_key" value="880ea6a14ea49e853634fbdc5015a024">
<input type="submit" aria-label="Login to site" title="Login" value="Login" class="bc_sub_btn">
<a aria-label="Sign in with Twitter" href="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=login&serviceClick=twitter&return=https://www.bleepingcomputer.com/news/security/apache-warns-of-critical-flaws-in-mina-hugegraph-traffic-control/" class="bc_twitter_btn"><img src="https://www.bleepstatic.com/images/site/login/twitter.png" width="28" height="24" alt="Sign in with Twitter button"> Sign in with Twitter</a>
<hr>
<p>Not a member yet? <a aria-label="Register account" title="Register account" href="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=register">Register Now</a></p>
</div>
</form><form>
<input type="hidden" id="comment-id-report" value="0">
<ul>
<li>
<label><input type="radio" name="comment-report-reason" value="Spam">Spam</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Abusive or Harmful">Abusive or Harmful</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Inappropriate content">Inappropriate content</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Strong language">Strong language</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Other">Other</label>
</li>
<li id="comment-report-other-reason-wrap" style="display:none;">
<textarea aria-label="Enter other reason for reporting the comment" rows="2" cols="2" id="comment-report-other-reason"></textarea>
</li>
</ul>
<p>Read our <a href="https://www.bleepingcomputer.com/posting-guidelines/">posting guidelinese</a> to learn what content is prohibited.</p>
</form>Text Content
WE VALUE YOUR PRIVACY
We and our partners store and/or access information on a device, such as cookies
and process personal data, such as unique identifiers and standard information
sent by a device for personalised advertising and content, advertising and
content measurement, audience research and services development. With your
permission we and our partners may use precise geolocation data and
identification through device scanning. You may click to consent to our and our
1466 partners’ processing as described above. Alternatively you may access more
detailed information and change your preferences before consenting or to refuse
consenting. Please note that some processing of your personal data may not
require your consent, but you have a right to object to such processing. Your
preferences will apply to this website only. You can change your preferences or
withdraw your consent at any time by returning to this site and clicking the
"Privacy" button at the bottom of the webpage.
Please note that this website/app uses one or more Google services and may
gather and store information including but not limited to your visit or usage
behaviour. You may click to grant or deny consent to Google and its third-party
tags to use your data for below specified purposes in below Google consent
section.
MORE OPTIONSAGREE
*
*
*
*
*
*
*
*
* News
* Featured
* Latest
* Clop ransomware is now extorting 66 Cleo data-theft victims
* FBI links North Korean hackers to $308 million crypto heist
* Adobe warns of critical ColdFusion bug with PoC exploit code
* Microsoft fixes bug behind random Office 365 deactivation errors
* Expand your resume by studying any of 1,000+ courses in this three-part
bundle
* Apache warns of critical flaws in MINA, HugeGraph, Traffic Control
* New 'OtterCookie' malware used to backdoor devs in fake job offers
* Windows 11 installation media bug causes security update failures
* Tutorials
* Latest
* Popular
* How to access the Dark Web using the Tor Browser
* How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11
* How to use the Windows Registry Editor
* How to backup and restore the Windows Registry
* How to start Windows in Safe Mode
* How to remove a Trojan, Virus, Worm, or other Malware
* How to show hidden files in Windows 7
* How to see hidden files in Windows
* Virus Removal Guides
* Latest
* Most Viewed
* Ransomware
* Remove the Theonlinesearch.com Search Redirect
* Remove the Smartwebfinder.com Search Redirect
* How to remove the PBlock+ adware browser extension
* Remove the Toksearches.xyz Search Redirect
* Remove Security Tool and SecurityTool (Uninstall Guide)
* How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo
* How to remove Antivirus 2009 (Uninstall Instructions)
* How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using
TDSSKiller
* Locky Ransomware Information, Help Guide, and FAQ
* CryptoLocker Ransomware Information Guide and FAQ
* CryptorBit and HowDecrypt Information Guide and FAQ
* CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ
* Downloads
* Latest
* Most Downloaded
* Qualys BrowserCheck
* STOPDecrypter
* AuroraDecrypter
* FilesLockerDecrypter
* AdwCleaner
* ComboFix
* RKill
* Junkware Removal Tool
* Deals
* Categories
* eLearning
* IT Certification Courses
* Gear + Gadgets
* Security
* VPNs
* Popular
* Best VPNs
* How to change IP address
* Access the dark web safely
* Best VPN for YouTube
* Forums
* More
* Startup Database
* Uninstall Database
* Glossary
* Chat on Discord
* Send us a Tip!
* Welcome Guide
* Home
* News
* Security
* Apache warns of critical flaws in MINA, HugeGraph, Traffic Control
*
*
APACHE WARNS OF CRITICAL FLAWS IN MINA, HUGEGRAPH, TRAFFIC CONTROL
By
BILL TOULAS
* December 26, 2024
* 01:27 PM
* 0
The Apache Software Foundation has released security updates to address three
severe problems that affect MINA, HugeGraph-Server, and Traffic Control
products.
The vulnerabilities were patched in new software versions released between
December 23 and 25. However, the holiday period may lead to a slower patching
rate and increased risk of exploitation.
One of the bugs is tracked as CVE-2024-52046 and impacts MINA versions 2.0
through 2.0.26, 2.1 through 2.1.9, and 2.2 through 2.2.3. The issue received a
critical severity score of 10 out of 10 from the Apache Software Foundation
Apache MINA is a network application framework that provides an abstraction
layer for developing high-performance and scalable network applications.
The latest problem lies in ‘ObjectSerializationDecoder’ caused by unsafe Java
deserialization, potentially leading to remote code execution (RCE).
The Apache team clarified that the vulnerability is exploitable if the
‘IoBuffer#getObject()’ method is used in combination with certain classes.
Apache addressed the issue with the release of versions 2.0.27, 2.1.10, and
2.2.4, which enhanced the vulnerable component with stricter security defaults.
However, upgrading to those versions isn't enough. Users also need to manually
set the rejection of all classes unless explicitly allowed by following one of
the three methods provided.
The vulnerability impacting Apache HugeGraph-Server versions 1.0 through 1.3, is
an authentication bypass problem tracked as CVE-2024-43441. It is caused by
improper validation of authentication logic.
Apache HugeGraph-Server is a graph database server that enables efficient
storage, querying, and analysis of graph-based data.
The authentication bypass problem was addressed in version 1.5.0, which is the
recommended upgrade target for HugeGraph-Server users.
The third flaw is identified as CVE-2024-45387 and the Apache Software
Foundation rated it with a 9.9 critical severity score. It is an SQL injection
problem impacting Traffic Ops versions 8.0.0 to 8.0.1.
Apache Traffic Control is a Content Delivery Network (CDN) management and
optimization tool.
The latest problem on the product is caused by the insufficient input
sanitization of SQL queries, allowing arbitrary SQL command execution using
specially crafted PUT requests.
The problem was fixed in Apache Traffic Control version 8.0.2, released earlier
this week. The Apache team noted that versions 7.0.0 to up to 8.0.0 are not
impacted.
System administrators are strongly recommended to upgrade to the latest product
version as soon as possible, especially as hackers often choose to strike during
this time of the year when companies have fewer employees on duty and response
times are longer.
RELATED ARTICLES:
Apache fixes remote code execution bypass in Tomcat web server
New critical Apache Struts flaw exploited to find vulnerable servers
Premium WPLMS WordPress plugins address seven critical flaws
Fortinet warns of FortiWLM bug giving hackers admin privileges
New Cleo zero-day RCE flaw exploited in data theft attacks
* Apache
* Authentication Bypass
* Remote Code Execution
* Security Advisory
* SQL Injection
* Vulnerability
*
*
*
*
*
BILL TOULAS
Bill Toulas is a tech writer and infosec news reporter with over a decade of
experience working on various online publications, covering open-source, Linux,
malware, data breach incidents, and hacks.
* Previous Article
* Next Article
POST A COMMENT COMMUNITY RULES
YOU NEED TO LOGIN IN ORDER TO POST A COMMENT
Not a member yet? Register Now
YOU MAY ALSO LIKE:
Popular Stories
* New botnet exploits vulnerabilities in NVRs, TP-Link routers
* Apache fixes remote code execution bypass in Tomcat web server
* Adobe warns of critical ColdFusion bug with PoC exploit code
Sponsor Posts
* Save IT time with self-service password resets
* Latrodectus malware and how to defend against it with Wazuh
* Inside the incident: Uncovering an advanced phishing attack
* Cynet Delivers 100% Protection and 100% Detection Visibility in 2024 MITRE
ATT&CK Evaluation
* Have Your AD Password Policy Meet NIST Requirements
FOLLOW US:
*
*
*
*
*
MAIN SECTIONS
* News
* VPN Buyer Guides
* SysAdmin Software Guides
* Downloads
* Virus Removal Guides
* Tutorials
* Startup Database
* Uninstall Database
* Glossary
COMMUNITY
* Forums
* Forum Rules
* Chat
USEFUL RESOURCES
* Welcome Guide
* Sitemap
COMPANY
* About BleepingComputer
* Contact Us
* Send us a Tip!
* Advertising
* Write for BleepingComputer
* Social & Feeds
* Changelog
Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure
Copyright @ 2003 - 2024 Bleeping Computer® LLC - All Rights Reserved
LOGIN
Username
Password
Remember Me
Sign in anonymously
Sign in with Twitter
--------------------------------------------------------------------------------
Not a member yet? Register Now
REPORTER
HELP US UNDERSTAND THE PROBLEM. WHAT IS GOING ON WITH THIS COMMENT?
* Spam
* Abusive or Harmful
* Inappropriate content
* Strong language
* Other
*
Read our posting guidelinese to learn what content is prohibited.
Submitting...
SUBMIT