[
https://issues.apache.org/jira/browse/FLINK-20875?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Chesnay Schepler updated FLINK-20875:
-------------------------------------
Description: Flink 1.5.1 introduced a REST handler that allows you to write
an uploaded file to an arbitrary location on the local file system, through a
maliciously modified HTTP HEADER. The files can be written to any location
accessible by Flink 1.5.1. (was: So many flink job of prod are running in
version 1.10。)
> [CVE-2020-17518] Directory traversal attack: remote file writing through the
> REST API
> -------------------------------------------------------------------------------------
>
> Key: FLINK-20875
> URL: https://issues.apache.org/jira/browse/FLINK-20875
> Project: Flink
> Issue Type: Bug
> Components: Runtime / REST
> Affects Versions: 1.9.0
> Reporter: Wong Mulan
> Assignee: Robert Metzger
> Priority: Blocker
> Fix For: 1.12.0, 1.10.3, 1.11.3
>
>
> Flink 1.5.1 introduced a REST handler that allows you to write an uploaded
> file to an arbitrary location on the local file system, through a maliciously
> modified HTTP HEADER. The files can be written to any location accessible by
> Flink 1.5.1.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
