GitHub Advisoryadvisory · Maven

GHSA-jj32-3pf5-5mv5 Apache InLong Deserialization of Untrusted Data Vulnerability

HIGH Published 2023-10-19 Modified 2023-10-31 Official page ↗
Aliases
CVE-2023-46227
Ecosystem
Maven
Packages
org.apache.inlong:manager-common, org.apache.inlong:manager-pojo
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-502
Reviewed
2023-10-19

Affected packages

• Maven org.apache.inlong:manager-common: >= 1.4.0, < 1.9.0 → fixed in 1.9.0 • Maven org.apache.inlong:manager-pojo: >= 1.4.0, < 1.9.0 → fixed in 1.9.0

Description

Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong. This issue affects Apache InLong: from 1.4.0 through 1.8.0, the attacker can use \t to bypass. Users are advised to upgrade to Apache InLong's 1.9.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/8814

Related

Alias · CVE (1)

  • CVE-2023-46227 Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong. vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References