PT-2024-5100 · Apache · Apache Linkis

Pho3N1X · Published 2024-07-13 · Updated 2024-08-01 · CVE-2023-46801

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Apache Linkis versions <= 1.5.0

Description: The issue is related to a deserialization vulnerability in the MySQL Data Source Handler component of Apache Linkis, which can be exploited for remote code execution. This can be achieved by injecting malicious files into the server through jrmp. The attack requires the attacker to have an authorized account from Linkis.

Recommendations: For Apache Linkis versions <= 1.5.0, upgrade the Java version to >= 1.8.0 241. For Apache Linkis versions <= 1.5.0, upgrade Linkis to version 1.6.0.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2024-05627

CVE-2023-46801

GHSA-JJVC-V8GW-5255

Affected Products

Apache Linkis

References · 11

• https://osv.dev/vulnerability/GHSA-jjvc-v8gw-5255 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-46801 · Security Note
• https://osv.dev/vulnerability/CVE-2023-46801 · Vendor Advisory
• https://lists.apache.org/thread/0dnzh64xy1n7qo3rgo2loz9zn7m9xgdx · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05627 · Security Note
• https://github.com/apache/linkis · Note
• https://vuldb.com/?id.271451 · Note
• https://linkis.apache.org/download/release-notes-1.6.0 · Note
• https://openwall.com/lists/oss-security/2024/07/13/6 · Note
• http://openwall.com/lists/oss-security/2024/07/13/6 · Note
• https://t.me/cvedetector/851 · Telegram Post