Skip to content

Permission checking in CSV File Source connector

Moderate
kwart published GHSA-8h4x-xvjp-vf99 Feb 15, 2024

Package

maven com.hazelcast:hazelcast (Maven)

Affected versions

>= 5.3.0, <= 5.3.4
>= 5.2.0, <= 5.2.4
<= 5.1.7

Patched versions

5.3.5
5.2.5
maven com.hazelcast:hazelcast-enterprise (Maven)
>= 5.3.0, <= 5.3.4
>= 5.2.0, <= 5.2.4
<= 5.1.7
5.3.5
5.2.5

Description

Impact

In Hazelcast Platform through 5.3.4, a security issue exists within the SQL mapping for the CSV File Source connector. This issue arises from inadequate permission checking, which could enable unauthorized clients to access data from files stored on a member's filesystem.

Patches

Fix versions: 5.3.5, 5.4.0-BETA-1

Workaround

Disabling Hazelcast Jet processing engine in Hazelcast member configuration workarounds the issue. As a result SQL and Jet jobs won't work.

Severity

Moderate
6.5
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CVE ID

CVE-2023-45860

Weaknesses

No CWEs