{"id":"GHSA-5x3v-2gxr-59m2","summary":"Directory traversal in Apache RocketMQ","details":"In Apache RocketMQ 4.2.0 to 4.6.0, when the automatic topic creation in the broker is turned on by default, an evil topic like “../../../../topic2020” is sent from rocketmq-client to the broker, a topic folder will be created in the parent directory in brokers, which leads to a directory traversal vulnerability. Users of the affected versions should apply one of the following: Upgrade to Apache RocketMQ 4.6.1 or later.","aliases":["CVE-2019-17572"],"modified":"2024-12-02T05:47:54.227291Z","published":"2020-07-01T17:26:15Z","database_specific":{"nvd_published_at":null,"cwe_ids":["CWE-22"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2020-07-01T17:26:05Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-17572"},{"type":"WEB","url":"https://github.com/apache/rocketmq/issues/1637"},{"type":"WEB","url":"https://github.com/apache/rocketmq/commit/f8f6fbe4aa7f5dee937e688322628c366b12a552"},{"type":"WEB","url":"https://lists.apache.org/thread.html/fdea1c5407da47a17d5522fa149a097cacded1916c1c1534d46edc6d%40%3Cprivate.rocketmq.apache.org%3E"},{"type":"WEB","url":"https://seclists.org/oss-sec/2020/q2/112"},{"type":"WEB","url":"https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEROCKETMQ-569108"}],"affected":[{"package":{"name":"org.apache.rocketmq:rocketmq-broker","ecosystem":"Maven","purl":"pkg:maven/org.apache.rocketmq/rocketmq-broker"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0"},{"fixed":"4.6.1"}]}],"versions":["4.2.0","4.3.0","4.3.1","4.3.2","4.4.0","4.5.0","4.5.1","4.5.2","4.6.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/07/GHSA-5x3v-2gxr-59m2/GHSA-5x3v-2gxr-59m2.json"}}],"schema_version":"1.9.0"}