PT-2022-5283 · Apache+1 · Apache Linkis+1

4Ra1N + 2 · Published 2022-10-26 · Updated 2022-10-28 · CVE-2022-39944

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Linkis versions 1.2.0 and earlier

Description A deserialization vulnerability exists in Apache Linkis when used with the MySQL Connector/J, potentially allowing remote code execution if an attacker has write access to a database and configures a JDBC EC with a MySQL data source and malicious parameters. The issue is related to the restoration of untrusted data in memory.

Recommendations For Apache Linkis versions 1.2.0 and earlier, update to version 1.3.0 to resolve the issue. As a temporary workaround, consider blacklisting parameters in the jdbc url to minimize the risk of exploitation.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2022-06567

CVE-2022-39944

GHSA-3F3W-GMQF-4HJ3

Affected Products

Apache Linkis

Mysql Connector/J

References · 7

• https://bdu.fstec.ru/vul/2022-06567 · Security Note
• https://osv.dev/vulnerability/CVE-2022-39944 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39944 · Security Note
• https://osv.dev/vulnerability/GHSA-3f3w-gmqf-4hj3 · Vendor Advisory
• https://github.com/apache/incubator-linkis · Note
• https://lists.apache.org/thread/rxytj48q17304snonjtyt5lnlw64gccc · Note
• https://t.me/pentestingnews/29550 · Telegram Post