PT-2023-5268 · Apache · Apache Inlong

4Ra1N + 1 · Published 2023-07-25 · Updated 2024-10-02 · CVE-2023-34434

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache InLong versions 1.4.0 through 1.7.0

Description The issue affects Apache InLong, allowing an attacker to bypass the current logic and achieve arbitrary file reading by exploiting a deserialization of untrusted data vulnerability. This could enable a remote attacker to read files arbitrarily.

Recommendations To solve this issue, users are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick https://github.com/apache/inlong/pull/8130.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2023-05885

CVE-2023-34434

GHSA-PQ67-9JF9-HC3C

Affected Products

Apache Inlong

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2023-34434 · Security Note
• https://bdu.fstec.ru/vul/2023-05885 · Security Note
• https://lists.apache.org/thread/7f1o71w5r732cspltmtdydn01gllf4jo · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-34434 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pq67-9jf9-hc3c · Vendor Advisory
• https://github.com/apache/inlong · Note
• https://github.com/apache/inlong/pull/8130 · Note
• https://github.com/apache/inlong/commit/34835f827771074345f42a9b1658d018f202516e · Note
• http://seclists.org/fulldisclosure/2023/Jul/43 · Note
• https://t.me/cibsecurity/67213 · Telegram Post
• https://t.me/cvenotify/55172 · Telegram Post
• https://t.me/cvenotify/96858 · Telegram Post
• https://t.me/cvenotify/55063 · Telegram Post
• http://openwall.com/lists/oss-security/2023/07/25/3 · Note