PT-2024-28740 · Apache · Apache Linkis+2

Hen + 1 · Published 2024-09-24 · Updated 2024-09-30 · CVE-2024-39928

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Linkis versions 1.3.0 through 1.5.0

Description A Random string security vulnerability exists in Spark EngineConn, where the random string generated by the Token when starting Py4j uses Commons Lang's RandomStringUtils.

Recommendations For Apache Linkis versions 1.3.0 through 1.5.0, upgrade to version 1.6.0 to fix this issue.

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

CVE-2024-39928

GHSA-6GCH-63WP-4V5F

Affected Products

Apache Linkis

Commons Lang

Spark Engineconn

References · 12

• https://lists.apache.org/thread/g664n13nb17rsogcfrn8kjgd8m89p8nw · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6gch-63wp-4v5f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-39928 · Security Note
• https://osv.dev/vulnerability/CVE-2024-39928 · Vendor Advisory
• https://github.com/apache/linkis · Note
• https://github.com/apache/linkis/commit/82c2f4b201b746e9206bb58ef98f536fc333aa07 · Note
• https://twitter.com/CVEnew/status/1838483361809027084 · Twitter Post
• https://twitter.com/cracbot/status/1839183236557320622 · Twitter Post
• https://twitter.com/oss_security/status/1838597110645526588 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1838582187165204799 · Twitter Post
• https://twitter.com/cracbot/status/1840632726791340499 · Twitter Post
• http://openwall.com/lists/oss-security/2024/09/24/2 · Note