GitHub Advisoryadvisory · Maven, PyPI

GHSA-rxgg-273w-rfw7 Remote Code Execution vulnerability in Apache IoTDB via UDF

HIGH Published 2024-01-15 Modified 2025-06-20 Official page ↗
Aliases
CVE-2023-46226
Ecosystem
Maven, PyPI
Packages
org.apache.iotdb:iotdb-core, apache-iotdb
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94
Reviewed
2024-01-16

Affected packages

• Maven org.apache.iotdb:iotdb-core: >= 1.0.0, < 1.3.0 → fixed in 1.3.0 • PyPI apache-iotdb: >= 1.0.0, < 1.3.0 → fixed in 1.3.0

Description

Remote Code Execution vulnerability in Apache IoTDB. This issue affects Apache IoTDB from 1.0.0 through 1.2.2. Users are recommended to upgrade to version 1.3.0, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2023-46226 Remote Code Execution vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 1.0.0 through 1.2.2. vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References