PT-2023-8729 · Apache · Apache Inlong

4Ra1N + 2 · Published 2023-05-21 · Updated 2024-10-11 · CVE-2023-31058

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache InLong versions 1.4.0 through 1.6.0

Description The issue is related to the deserialization of untrusted data, which allows attackers to bypass the autoDeserialize option filtering by adding blanks. This can potentially lead to the execution of arbitrary code.

Recommendations To solve the issue, users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7674.

Fix

Deserialization of Untrusted Data

RCE

Weakness Enumeration

CWE-502

CWE-20

Related Identifiers

BDU:2024-01759

CVE-2023-31058

GHSA-C3RH-F2W5-FGHM

Affected Products

Apache Inlong

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2023-31058 · Security Note
• https://lists.apache.org/thread/bkcgbn9l61croxfyspf7xd42qb189s3z · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-31058 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c3rh-f2w5-fghm · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01759 · Security Note
• https://github.com/apache/inlong · Note
• https://github.com/apache/inlong/pull/7674 · Note
• https://t.me/cibsecurity/64526 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2023080118 · Note
• https://vuldb.com/ru/?id.229641 · Note