PT-2023-22210 · Apache · Apache Linkis

Sw0Rd1Ight · Published 2023-04-10 · Updated 2024-10-22 · CVE-2023-29216

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Linkis versions 1.3.1 and earlier

Description The issue arises because parameters are not effectively filtered in Apache Linkis, allowing an attacker to use the MySQL data source and malicious parameters to configure a new data source. This triggers a deserialization vulnerability, eventually leading to remote code execution.

Recommendations For Apache Linkis versions 1.3.1 and earlier, upgrade the version of Linkis to version 1.3.2.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2023-29216

GHSA-RRHF-32RQ-F28H

Affected Products

Apache Linkis

References · 8

• https://osv.dev/vulnerability/GHSA-rrhf-32rq-f28h · Vendor Advisory
• https://lists.apache.org/thread/18vv0m32oy51nzk8tbz13qdl5569y55l · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-29216 · Security Note
• https://osv.dev/vulnerability/CVE-2023-29216 · Vendor Advisory
• https://github.com/apache/linkis · Note
• https://t.me/cibsecurity/61740 · Telegram Post
• http://openwall.com/lists/oss-security/2023/04/10/5 · Note
• https://linkis.apache.org/download/release-notes-1.3.2 · Note