PT-2023-8729 · Apache · Apache Inlong

4Ra1N + 2 · Publicado 2023-05-21 · Atualizado 2024-10-11 · CVE-2023-31058

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache InLong versions 1.4.0 through 1.6.0

Description The issue is related to the deserialization of untrusted data, which allows attackers to bypass the autoDeserialize option filtering by adding blanks. This can potentially lead to the execution of arbitrary code.

Recommendations To solve the issue, users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7674.

Correção

Deserialization of Untrusted Data

RCE

Enumeração de Fraquezas

CWE-502

CWE-20

Identificadores relacionados

BDU:2024-01759

CVE-2023-31058

GHSA-C3RH-F2W5-FGHM

Produtos afetados

Apache Inlong

Referências · 10

• https://github.com/apache/inlong · Nota
• https://github.com/apache/inlong/pull/7674 · Nota
• https://t.me/cibsecurity/64526 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-31058 · Nota de Segurança
• https://lists.apache.org/thread/bkcgbn9l61croxfyspf7xd42qb189s3z · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-31058 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-c3rh-f2w5-fghm · Aviso do Fabricante
• https://cybersecurity-help.cz/vdb/SB2023080118 · Nota
• https://vuldb.com/ru/?id.229641 · Nota
• https://bdu.fstec.ru/vul/2024-01759 · Nota de Segurança