PT-2023-21058 · Apache+1 · Apache Inlong+1

Escape Wang · Published 2023-03-27 · Updated 2024-10-23 · CVE-2023-27296

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache InLong versions 1.1.0 through 1.5.0

Description The issue is related to the deserialization of untrusted data in Apache InLong, which could be triggered by authenticated users. This vulnerability affects the MySQLDataNode due to the deserialization of untrusted data from the MySQL JDBC URL.

Recommendations For Apache InLong versions 1.1.0 through 1.5.0, users are advised to upgrade to Apache InLong's latest version or cherry-pick the patch to solve the issue. As a temporary workaround, consider restricting access to the MySQLDataNode to minimize the risk of exploitation.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2023-27296

GHSA-GPQQ-59RP-3C3W

Affected Products

Apache Inlong

Mysql Server

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2023-27296 · Security Note
• https://osv.dev/vulnerability/CVE-2023-27296 · Vendor Advisory
• https://lists.apache.org/thread/xbvtjw9bwzgbo9fp1by8o3p49nf59xzt · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gpqq-59rp-3c3w · Vendor Advisory
• https://github.com/apache/inlong · Note
• https://github.com/apache/inlong/pull/7422 · Note
• https://t.me/cvenotify/47239 · Telegram Post
• https://t.me/cibsecurity/60793 · Telegram Post
• https://programmer.help/blogs/jdbc-deserialization-vulnerability-learning.html · Note
• https://t.me/cvenotify/99239 · Telegram Post