GitHub Advisoryadvisory · Maven

GHSA-gpqq-59rp-3c3w Apache InLong vulnerable to JDBC Deserialization of Untrusted Data

HIGH Published 2023-03-27 Modified 2023-03-31 Official page ↗
Aliases
CVE-2023-27296
Ecosystem
Maven
Packages
org.apache.inlong:inlong-manager
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2023-03-27

Affected packages

• Maven org.apache.inlong:inlong-manager: >= 1.1.0, < 1.6.0 → fixed in 1.6.0

Description

Apache InLong versions from 1.1.0 through 1.5.0 are vulnerable to Java Database Connectivity (JDBC) deserialization of untrusted data from the MySQL JDBC URL in MySQLDataNode. It could be triggered by authenticated users of InLong. This has been patched in version 1.6.0. Users are advised to upgrade to Apache InLong's latest version or cherry-pick the patch to solve it.

Related

Alias · CVE (1)

  • CVE-2023-27296 Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache InLong. vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References