PT-2022-6257 · Apache+1 · Apache Linkis+1

Bearcat + 3 · Published 2022-11-03 · Updated 2023-02-07 · CVE-2022-44645

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Linkis versions 1.3.0 and earlier

Description A deserialization vulnerability exists in Apache Linkis when used with the MySQL Connector/J, allowing for possible remote code execution impact. This occurs when an attacker has write access to a database and configures a new datasource with a MySQL data source and malicious parameters. The parameters in the jdbc url should be blacklisted to prevent exploitation.

Recommendations For Apache Linkis versions 1.3.0 and earlier, upgrade to version 1.3.1 to resolve the issue. As a temporary workaround, consider blacklisting malicious parameters in the jdbc url to minimize the risk of exploitation. Restrict access to the MySQL Connector/J to prevent attackers from configuring new datasources with malicious parameters.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2023-00672

CVE-2022-44645

GHSA-H6W8-52MQ-4QXC

Affected Products

Apache Linkis

Mysql Connector/J

References · 10

• https://lists.apache.org/thread/zlcfmvt65blqc4n6fxypg6f0ns8fqfz4 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h6w8-52mq-4qxc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-44645 · Security Note
• https://bdu.fstec.ru/vul/2023-00672 · Security Note
• https://osv.dev/vulnerability/CVE-2022-44645 · Vendor Advisory
• https://github.com/apache/linkis · Note
• https://github.com/advisories/GHSA-h6w8-52mq-4qxc · Note
• https://vuldb.com/ru/?id.219791 · Note
• https://t.me/cibsecurity/57214 · Telegram Post
• https://inergency.com/cve-2022-44645 · Note