PT-2022-4972 · Apache · Apache Inlong

4Ra1N + 1 · Published 2022-09-15 · Updated 2025-05-29 · CVE-2022-40955

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache InLong versions prior to 1.3.0

Description The issue is related to the deserialization of untrusted data in the MySQL JDBC connection URL parameters, potentially leading to Remote Code Execution on the Apache InLong server. An attacker with sufficient privileges to specify these parameters and write arbitrary data to the MySQL database could exploit this issue.

Recommendations For versions prior to 1.3.0, upgrade to Apache InLong 1.3.0 or newer. As a temporary workaround, consider restricting access to the MySQL database and limiting privileges to specify MySQL JDBC connection URL parameters until a patch is applied.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-641

CWE-502

Related Identifiers

BDU:2022-06168

CVE-2022-40955

GHSA-26M4-QJP9-XMC6

Affected Products

Apache Inlong

References · 14

• https://bdu.fstec.ru/vul/2022-06168 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-40955 · Security Note
• https://lists.apache.org/thread/r1r34y7bchrpmp9jhfdoohzdmk7pj1q1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-26m4-qjp9-xmc6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-40955 · Vendor Advisory
• https://github.com/apache/inlong · Note
• https://t.me/cibsecurity/50140 · Telegram Post
• https://openwall.com/lists/oss-security/2022/09/22/5 · Note
• https://lists.apache.org/thread/k974vxlj586yw0mw0xvl47mqgzlbsz7j · Note
• http://openwall.com/lists/oss-security/2022/09/22/5 · Note
• https://t.me/pentestingnews/28335 · Telegram Post
• https://news.apache.org/foundation/entry/the-apache-news-round-up274 · Note
• https://t.me/cvenotify/123973 · Telegram Post
• https://github.com/advisories/GHSA-26m4-qjp9-xmc6 · Note