GitHub Advisoryadvisory · Maven

GHSA-6gch-63wp-4v5f Apache Linkis Spark EngineConn: Commons Lang's RandomStringUtils Random string security vulnerability

HIGH Published 2024-09-25 Modified 2025-05-16 Official page ↗
Aliases
CVE-2024-39928
Ecosystem
Maven
Packages
org.apache.linkis:linkis-engineplugin-spark
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-326
Reviewed
2024-09-25

Affected packages

• Maven org.apache.linkis:linkis-engineplugin-spark: < 1.6.0 → fixed in 1.6.0

Description

In Apache Linkis <= 1.5.0, a Random string security vulnerability in Spark EngineConn, random string generated by the Token when starting Py4j uses the Commons Lang's RandomStringUtils. Users are recommended to upgrade to version 1.6.0, which fixes this issue.

Related

Alias · CVE (1)

  • CVE-2024-39928 In Apache Linkis <= 1.5.0, a Random string security vulnerability in Spark EngineConn, random string generated by the Token when starting… vulnerability

Weakness · CWE (1)

  • CWE-326 Inadequate Encryption Strength weakness

References