From d2309e47a142f8a285dbdffca7b7cffe9b07d888 Mon Sep 17 00:00:00 2001 From: Krzysztof Opasiak Date: Wed, 5 Jun 2019 02:12:32 +0200 Subject: [PATCH] Document OJSI-101 vulnerability Issue-ID: OJSI-101 Signed-off-by: Krzysztof Opasiak Change-Id: Ib87725793f23876eb6df9ed6ef6dcf6acb6e36a9 --- docs/release-notes.rst | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/release-notes.rst b/docs/release-notes.rst index dafdf3c5dc..6dfb77aacb 100644 --- a/docs/release-notes.rst +++ b/docs/release-notes.rst @@ -109,6 +109,7 @@ Security Notes - CVE-2019-12119 [`OJSI-80 `__\ ] - demo-sdc-sdc-wfd-fe exposes JDWP on port 7000 which allows for arbitrary code execution - [`OJSI-90 `__\ ] - SDC exposes unprotected API for user creation - [`OJSI-94 `__\ ] - sdc-wfd-fe allows to impersonate any user by setting USER_ID +- [`OJSI-101 `__\ ] - In default deployment SDC (sdc-be) exposes HTTP port 30205 outside of cluster. *Known Vulnerabilities in Used Modules* -- 2.16.6