Source: jackrabbit Version: 2.20.11-1.1 Severity: grave Tags: security upstream Justification: user security hole X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for jackrabbit. CVE-2026-92414[0]: | : Session Fixation / Session Reuse across Users vulnerability in | Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached | authenticated session on any Lock- | Token/TransactionId/SubscriptionId/If-header field token match with | no credential check. This issue affects Apache Jackrabbit: from | 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 | through 2.20.17. Users are recommended to upgrade to | versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue. CVE-2026-92415[1]: | — Use of Externally-Controlled Input to Select Classes or Code | vulnerability in Apache Jackrabbit's WebDAV/Davex client. A | malicious WebDAV/DavEx server, or an attacker able to intercept the | connection, can cause the client to instantiate arbitrary classes | from its classpath, which can lead to arbitrary file creation or | truncation. Only applications that use jackrabbit-spi2dav (directly | or through jackrabbit-jcr2dav) to connect to a remote repository are | affected. Jackrabbit servers are not affected. Category: unsafe | reflection on wire data (HIGH). This issue affects Apache | Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, | from 2.20.0 through 2.20.17. Users are recommended to upgrade to | versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-92414 https://www.cve.org/CVERecord?id=CVE-2026-92414 https://www.openwall.com/lists/oss-security/2026/10/07/27 [1] https://security-tracker.debian.org/tracker/CVE-2026-92415 https://www.cve.org/CVERecord?id=CVE-2026-92415 https://www.openwall.com/lists/oss-security/2026/10/07/28 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
