PT-2024-14291 · Apache · Apache Inlong

X1R0Z · Published 2024-01-03 · Updated 2024-09-06 · CVE-2023-51785

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache InLong versions 1.7.0 through 1.9.0

Description The issue is related to the deserialization of untrusted data in Apache InLong, allowing attackers to perform an arbitrary file read attack using the mysql driver.

Recommendations For Apache InLong versions 1.7.0 through 1.9.0, upgrade to Apache InLong's 1.10.0 or cherry-pick the fix from https://github.com/apache/inlong/pull/9331 to solve the issue.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2023-51785

GHSA-CRWJ-2R3C-GX2G

Affected Products

Apache Inlong

References · 15

• https://lists.apache.org/thread/g0yjmtjqvp8bnf1j0tdsk0nhfozjdjno · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-51785 · Security Note
• https://osv.dev/vulnerability/CVE-2023-51785 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-crwj-2r3c-gx2g · Vendor Advisory
• https://github.com/apache/inlong · Note
• https://github.com/apache/inlong/commit/d674bfe28416aff728eabafc1f6b8bb9ba5a5b8e · Note
• https://github.com/apache/inlong/pull/9331 · Note
• https://twitter.com/VulmonFeeds/status/1742510686326886612 · Twitter Post
• https://twitter.com/CVEnew/status/1742484073912717758 · Twitter Post
• https://twitter.com/oss_security/status/1742510689783025692 · Twitter Post
• https://t.me/cvenotify/66058 · Telegram Post
• https://t.me/cibsecurity/74314 · Telegram Post
• http://openwall.com/lists/oss-security/2024/01/03/2 · Note
• https://twitter.com/fletch_ai/status/1744571471836451281 · Twitter Post
• https://t.me/cvenotify/93567 · Telegram Post