GitHub Advisoryadvisory · Maven

GHSA-jj4f-p7vv-j4v9 Arbitrary code execution in Apache Druid

HIGH Published 2021-06-16 Modified 2022-06-06 Official page ↗
Aliases
CVE-2021-26919
Ecosystem
Maven
Packages
org.apache.druid:druid
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-668
Reviewed
2021-03-31

Affected packages

• Maven org.apache.druid:druid: < 0.20.2 → fixed in 0.20.2

Description

Apache Druid allows users to read data from other database systems using JDBC. This functionality is to allow trusted users with the proper permissions to set up lookups or submit ingestion tasks. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker to execute arbitrary code from a hacker-controlled malicious MySQL server within Druid server processes. This issue was addressed in Apache Druid 0.20.2

Related

Alias · CVE (1)

  • CVE-2021-26919 Apache Druid allows users to read data from other database systems using JDBC. vulnerability

Weakness · CWE (1)

  • CWE-668 Exposure of Resource to Wrong Sphere weakness

References