| Package | Affected versions | Patched versions |
|---|---|---|
| com.hazelcast:hazelcast | ≥ 5.2.0, < 5.2.5≥ 5.3.0, < 5.3.5≤ 5.1.7 | 5.2.55.3.5 |
| com.hazelcast:hazelcast-enterprise | ≥ 5.2.0, < 5.2.5≥ 5.3.0, < 5.3.5≤ 5.1.7 | 5.2.55.3.5 |
| hazelcast | ≥ 5.2.0, < 5.2.5≥ 5.3.0, < 5.3.5≤ 5.1.7 | 5.2.55.3.5 |
In Hazelcast Platform through 5.3.4, a security issue exists within the SQL mapping for the CSV File Source connector. This issue arises from inadequate permission checking, which could enable unauthorized clients to access data from files stored on a member's filesystem.
Fix versions: 5.3.5, 5.4.0-BETA-1
Disabling Hazelcast Jet processing engine in Hazelcast member configuration workarounds the issue. As a result SQL and Jet jobs won't work.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free