GitHub Advisoryadvisory · Maven
GHSA-qm2h-m799-86rc Apache Linkis JDBC EngineConn has deserialization vulnerability
CRITICAL
Official page ↗
- Aliases
- CVE-2023-29215
- Ecosystem
- Maven
- Packages
- org.apache.linkis:linkis-engineconn
- Severity
- Critical
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-502
- Reviewed
- 2023-04-10
Affected packages
• Maven org.apache.linkis:linkis-engineconn: < 1.3.2 → fixed in 1.3.2
Description
In Apache Linkis <=1.3.1, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in JDBC EngineConn Module will trigger a deserialization vulnerability and eventually lead to remote code execution. Therefore, the parameters in the Mysql JDBC URL should be blacklisted. Users should upgrade their version of Linkis to version 1.3.2.
Related
Alias · CVE (1)
- CVE-2023-29215 In Apache Linkis <=1.3.1, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in… vulnerability
Weakness · CWE (1)
- CWE-502 Deserialization of Untrusted Data weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-29215 advisory
- https://github.com/apache/linkis/commit/7005c01d7f7bca78322447f4f2f32b8398645687 web
- https://github.com/apache/linkis package
- https://linkis.apache.org/download/release-notes-1.3.2 web
- https://lists.apache.org/thread/o682wz1ggq491ybvjwokxvcdtnzo76ls web
- http://www.openwall.com/lists/oss-security/2023/04/10/4 web