Apache Ranger policy engine incorrectly matches paths in certain conditions

MOYENNE 5.9CVE-2016-8746 · GHSA-xv7x-x6wr-xx7g · Published 14/06/2017 · updated 17/06/2026

En bref

CVE-2016-8746 est une vulnérabilité MOYENNE (CVSS 5.9) touchant org.apache.ranger:ranger-plugins-common, ranger (apache).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 2.7%, plus élevée que 86.1% des vulnérabilités.
Correctif : mettre à jour vers 0.6.3 ou plus récent.

Package	Affected versions	Patched versions
org.apache.ranger:ranger-plugins-common Maven	`< 0.6.3`	`0.6.3`
ranger apache	`≤ 0.6.2`	No fix yet

Description

Apache Ranger before 0.6.3 policy engine incorrectly matches paths in certain conditions when policy does not contain wildcards and has recursion flag set to true.

NVD description

Apache Ranger before 0.6.3 policy engine incorrectly matches paths in certain conditions when policy does not contain wildcards and has recursion flag set to true.

References

nvd.nist.gov/vuln/detail/CVE-2016-8746 · ADVISORY
apache/ranger commit 2fcd7f7 · WEB
cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger · WEB
GitHub Advisory GHSA-xv7x-x6wr-xx7g · ADVISORY
securityfocus.com/bid/95998 · WEB

Autres vulnérabilités de org.apache.ranger:ranger-plugins-common

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.apache.ranger:ranger-plugins-common

Maven

< 0.6.3

0.6.3

ranger

apache

≤ 0.6.2

No fix yet

Description

Apache Ranger before 0.6.3 policy engine incorrectly matches paths in certain conditions when policy does not contain wildcards and has recursion flag set to true.

NVD description

Apache Ranger before 0.6.3 policy engine incorrectly matches paths in certain conditions when policy does not contain wildcards and has recursion flag set to true.