The Apache News Round-up: week ending 15 October 2021

2021-10-15 Thread Swapnil M Mane
Happy Friday, everyone. The Apache community has had another great
week. Let's review what we've been up to:

ASF Board – management and oversight of the business affairs of the
corporation in accordance with the Foundation's bylaws.
 - Next Board Meeting: 20 October 2021. Board calendar and minutes
https://apache.org/foundation/board/calendar.html

ApacheCon™ – the ASF's official global conference series, bringing
Tomorrow's Technology Today since 1998.
 - Our 2021 events are complete: thanks to all speakers, sponsors,
participants, and planners for their great turnout!
 - Presentations for ApacheCon Asia are available on the ASF YouTube
channel. ApacheCon@Home presentations will be posted shortly.
https://www.youtube.com/c/TheApacheFoundation/

ASF Infrastructure – our distributed team on three continents keeps
the ASF's infrastructure running around the clock.
 - 7M+ weekly checks yield uptime at 100.00%. Performance checks
across 50 different service components spread over more than 250
machines in data centers around the world. View the Apache
Infrastructure Uptime site to see the most recent averages.
http://www.apache.org/uptime/

Apache Code Snapshot – Over the past week, 305 Apache Committers
changed 2,145,460 lines of code over 2,767 commits. Top 5
contributors, in order, are: Claus Ibsen, Jarek Potiuk, Tilman
Hausherr, Tamas Cservenak, and Jacques Le Roux.

Apache Project Announcements – the latest updates by category.

Big Data --
 - Apache Storm 1.2.4, 2.1.1 and 2.2.1 released https://storm.apache.org/
 - Apache Calcite Avatica 1.19.0 released https://calcite.apache.org/
 - Apache CouchDB 3.2.0 released https://couchdb.apache.org/
 - Apache ShardingSphere ElasticJob 3.0.1 released
https://shardingsphere.apache.org/elasticjob/

Business Intelligence --
 - Apache Superset CVE-2021-41971: Possible SQL Injection when
template processing is enabled https://s.apache.org/tkdgs

Content
 - Apache OpenOffice 4.1.11 released https://www.openoffice.org/
   -- CVE-2021-41830: Double Certificate Attack https://s.apache.org/sv503
   -- CVE-2021-41831: Timestamp Manipulation with Signature Wrapping
https://s.apache.org/46tre
   -- CVE-2021-41832: Content Manipulation with Certificate Validation
Attack https://s.apache.org/fm3ys
 - Apache Jackrabbit 2.21.8 and Oak 1.22.9 released
http://jackrabbit.apache.org/
 - Apache Syncope 2.1.10 released https://syncope.apache.org/

Geospatial --
 - Apache SIS 1.1 released http://sis.apache.org/

Integration --
 - Apache Camel 3.11.3 (LTS) released https://camel.apache.org/

Observability --
 - Apache SkyWalking Client JS 0.7.0 released https://skywalking.apache.org/

Orchestration --
 - Apache Hop (Incubating) 1.0 released https://hop.apache.org/

Servers --
 - Apache Tomcat 8.5.72 released https://tomcat.apache.org/
   -- CVE-2021-42340: Apache Tomcat DoS https://s.apache.org/kcemf
 - Apache Traffic Control 6.0.0 released https://trafficserver.apache.org/
   -- CVE-2021-42009: Control Arbitrary Email Content Insertion in
/deliveryservices/request https://s.apache.org/7y11l

Workflow --
 - Apache Airflow 2.2.0 released https://airflow.apache.org/
 - Apache Airflow Providers (Amazon 2.3.0) released https://s.apache.org/hzu9p

Did You Know?

 - Did you know that the ASF has moved to CDN distribution for
software? 
https://blogs.apache.org/foundation/entry/apache-software-foundation-moves-to

 - Did you know that Druid Summit will be held online 9-10 November?
http://druid.apache.org/

 - Did you know that the next 3Hx - Apache Hop (Incubating) Hot Hop
Hangout will be held online 28 October?
https://hop.apache.org/community/events/

Apache Community Notices

- The Apache Month in Review: September 2021
https://s.apache.org/September2021 and video highlights
https://youtu.be/v3GdwUmevog

- Watch "Trillions and Trillions Served"
https://www.youtube.com/watch?v=JUt2nb0mgwg, the documentary on the
ASF
  1) full feature [49 min] https://www.youtube.com/watch?v=JUt2nb0mgwg
  2) "Apache Everywhere" [6 min] https://www.youtube.com/watch?v=nXtIti9jMFI
  3) "Why Apache" [2.5 min] https://www.youtube.com/watch?v=YM5dLvNatRs
  4) “Apache Innovation” [40 min] https://www.youtube.com/watch?v=qkvqJaX4S50

 - ASF Annual Report: FY2021
   -- Press release
https://blogs.apache.org/foundation/entry/the-apache-software-foundation-announces78
   -- Report (PDF) https://www.apache.org/foundation/docs/FY2021AnnualReport.pdf

 - The Apache Month in Review: August 2021
https://blogs.apache.org/foundation/entry/apache-month-in-review-august1

 - The Apache Way to Sustainable Open Source Success https://s.apache.org/GhnI

 - Foundation Reports and Statements
http://www.apache.org/foundation/reports.html

 - Presentations from ApacheCon Asia are available on YouTube
https://www.youtube.com/c/TheApacheFoundation/playlists?app=desktop=50=dd_id=2

 - "Success at Apache" focuses on the people and processes behind why
the ASF "just works."

 - Inside Infra: the new interview series with members of the 

CVE-2021-41971: Apache Superset: Possible SQL Injection when template processing is enabled

2021-10-15 Thread Daniel Gaspar
Severity: low

Description:

Apache Superset up to and including 1.3.0 when configured with 
ENABLE_TEMPLATE_PROCESSING on (disabled by default) allowed SQL injection when 
a malicious authenticated user sends an http request with a custom URL.


Mitigation:

Don't enable ENABLE_TEMPLATE_PROCESSING (disabled by default).
Or upgrade to Apache Superset 1.3.1 

Credit:

Apache Superset would like to thank Kevin Kusnardi for reporting this issue