| Package | Affected versions | Patched versions |
|---|---|---|
| org.geoserver.web:gs-web-app | < 1.6.1 | 1.6.1 |
| org.geoserver:gs-main | < 1.6.1 | 1.6.1 |
| geoserver | = 1.3.0= 1.3.2= 1.4.0= 1.5.0= 1.5.1= 1.5.2= 1.5.3= 1.6.0= 1.7.0= 3.0≤ 1.6.0 |
This advisory has been withdrawn as there the effects of the bug would only give the caller an incomplete view of data which they would be authorized to see.
PartialBufferOutputStream2 in GeoServer before 1.6.1 and 1.7.0-beta1 attempts to flush buffer contents even when it is handling an "in memory buffer," which prevents the reporting of a service exception, with unknown impact and attack vectors.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free