PT-2020-12961 · Apache+1 · Apache Zeppelin+2

Published 2020-12-18 · Updated 2024-05-01 · CVE-2020-11974

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DolphinScheduler versions 1.2.0 through 1.2.1 Apache Zeppelin versions prior to 0.11.1

Description A remote code execution issue exists when choosing MySQL as the database, potentially allowing an attacker to inject sensitive configuration or malicious code via the MySQL connector/j or JDBC driver.

Recommendations For DolphinScheduler versions 1.2.0 and 1.2.1, consider disabling the MySQL connector/j until a patch is available. For Apache Zeppelin versions prior to 0.11.1, upgrade to version 0.11.1 to fix the issue.

Fix

Deserialization of Untrusted Data

Code Injection

Weakness Enumeration

CWE-502

CWE-94

Related Identifiers

CVE-2020-11974

GHSA-66J8-C83M-GJ5F

GHSA-JPJ4-5XWP-CV23

Affected Products

Apache Zeppelin

Dolphinscheduler

Mysql Server

References · 29

• https://lists.apache.org/thread.html/rcbe4c248ef0c566e99fd19388a6c92aeef88167286546b675e9b1769%40%3Cdev.dolphinscheduler.apache.org%3E · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11974 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-31864 · Security Note
• https://cve.org/CVERecord?id=CVE-2020-11974 · Security Note
• https://osv.dev/vulnerability/GHSA-jpj4-5xwp-cv23 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-66j8-c83m-gj5f · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-11974 · Vendor Advisory
• https://github.com/apache/zeppelin · Note
• https://github.com/apache/zeppelin/pull/4709 · Note
• https://github.com/apache/zeppelin/commit/e65b5430e43c076c138a1f56e3f2aba1324118f2 · Note
• https://lists.apache.org/thread.html/r0de5e3d5516467c9429a8d4356eca17ccf156337345ac6b104748acb@%3Ccommits.dolphinscheduler.apache.org%3E · Note
• http://openwall.com/lists/oss-security/2024/04/09/8 · Note
• https://lists.apache.org/thread.html/r33452d7b99a293bcf8f3e4bd664943847e2602e03a9e45d09d3f508a@%3Ccommits.dolphinscheduler.apache.org%3E · Note
• https://t.me/cvenotify/78735 · Telegram Post
• https://lists.apache.org/thread.html/r33452d7b99a293bcf8f3e4bd664943847e2602e03a9e45d09d3f508a%40%3Ccommits.dolphinscheduler.apache.org%3E · Note