GitHub Advisoryadvisory · Maven

GHSA-7qpc-4xx9-x5qw Apache Linkis DataSource's JDBC Datasource Module with DB2 has JNDI Injection vulnerability

HIGH Published 2024-07-15 Modified 2025-03-27 Official page ↗
Aliases
CVE-2023-49566
Ecosystem
Maven
Packages
org.apache.linkis:linkis-datasource
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2024-07-15

Affected packages

• Maven org.apache.linkis:linkis-datasource: < 1.6.0 → fixed in 1.6.0

Description

In Apache Linkis <=1.5.0, due to the lack of effective filteringof parameters, an attacker configuring malicious `db2` parameters in the DataSource Manager Module will result in jndi injection. Therefore, the parameters in the DB2 URL should be blacklisted.  This attack requires the attacker to obtain an authorized account from Linkis before it can be carried out. Versions of Apache Linkis <=1.5.0 will be affected. We recommend users upgrade the version of Linkis to version 1.6.0.

Related

Alias · CVE (1)

  • CVE-2023-49566 In Apache Linkis <=1.5.0, due to the lack of effective filtering of parameters, an attacker configuring malicious db2 parameters in the… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References