PT-2023-22210 · Apache · Apache Linkis

Sw0Rd1Ight · Publicado 2023-04-10 · Atualizado 2024-10-22 · CVE-2023-29216

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Linkis versions 1.3.1 and earlier

Description The issue arises because parameters are not effectively filtered in Apache Linkis, allowing an attacker to use the MySQL data source and malicious parameters to configure a new data source. This triggers a deserialization vulnerability, eventually leading to remote code execution.

Recommendations For Apache Linkis versions 1.3.1 and earlier, upgrade the version of Linkis to version 1.3.2.

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2023-29216

GHSA-RRHF-32RQ-F28H

Produtos afetados

Apache Linkis

Referências · 8

• https://github.com/apache/linkis · Nota
• https://osv.dev/vulnerability/GHSA-rrhf-32rq-f28h · Aviso do Fabricante
• https://t.me/cibsecurity/61740 · Publicação no Telegram
• https://lists.apache.org/thread/18vv0m32oy51nzk8tbz13qdl5569y55l · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2023/04/10/5 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-29216 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-29216 · Aviso do Fabricante
• https://linkis.apache.org/download/release-notes-1.3.2 · Nota