GHSA-758m-6g3q-g3hh

Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '' wildcard character

At a glance

Published: 2018-10-17 17:22 UTC
Updated: 2023-11-08 03:59 UTC
CVE: CVE-2017-7676
CVSS_V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '*' wildcard character - like my*test, test*.txt. This can result in unintended behavior.

Affected packages

Package	Versions
Maven · org.apache.ranger:ranger	introduced 0, fixed 0.7.1

References

https://nvd.nist.gov/vuln/detail/CVE-2017-7676 ADVISORY
https://cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger WEB
https://github.com/advisories/GHSA-758m-6g3q-g3hh ADVISORY
http://www.securityfocus.com/bid/98958 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database