Hugegraph Raft Node Exploit

Hugegraph is an open-source graph database that utilizes the Apache Cassandra and Apache HBase databases for storage. A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store, allowing attackers to execute arbitrary commands on the system.

You're affected if you use A remote code execution vulnerability exists where a malicious Raft node can exploit. Specific version info not stated in the advisory. If you don't recognise this software, you're probably not affected.

To fix this issue, upgrade to Hugegraph version 1.7.0 or later from the official GitHub repository: https://github.com/apache/incubator-hugegraph

Immediate mitigations:

• Restrict network access to your Hugegraph instance (firewall it from the public internet)
• Audit Raft node activity for suspicious access patterns
• Monitor for unauthorized Hessian deserialization requests

• github.com
• lists.apache.org
• www.openwall.com