GitHub Advisoryadvisory · Maven

GHSA-3f3w-gmqf-4hj3 Apache Linkis subject to Remote Code Execution via deserialization

HIGH Published 2022-10-26 Modified 2022-10-31 Official page ↗
Aliases
CVE-2022-39944
Ecosystem
Maven
Packages
org.apache.linkis:linkis
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2022-10-27

Affected packages

• Maven org.apache.linkis:linkis: < 1.3.0 → fixed in 1.3.0

Description

In Apache Linkis <=1.2.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attacker has write access to a database and configures a JDBC EC with a MySQL data source and malicious parameters. Therefore, the parameters in the jdbc url should be blacklisted. This issue is patched in version 1.3.0, and users are recommended to upgrade.

Related

Alias · CVE (1)

  • CVE-2022-39944 In Apache Linkis <=1.2.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References