PT-2024-5102 · Apache · Apache Linkis

Joyh + 1 · Published 2024-07-13 · Updated 2024-07-16 · CVE-2023-49566

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Apache Linkis versions <=1.5.0

Description: The issue is related to the lack of effective filtering of parameters in the DataSource Manager Module of Apache Linkis. This allows an attacker to configure malicious db2 parameters, resulting in jndi injection. The attack requires the attacker to obtain an authorized account from Linkis before it can be carried out.

Recommendations: For Apache Linkis versions <=1.5.0, upgrade the version of Linkis to version 1.6.0. As a temporary workaround, consider blacklisting the parameters in the DB2 URL to minimize the risk of exploitation. Restrict access to the DataSource Manager Module to authorized accounts only.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2024-05629

CVE-2023-49566

GHSA-7QPC-4XX9-X5QW

Affected Products

Apache Linkis

References · 10

• https://lists.apache.org/thread/t68yy52lmv7pxgrxnq6rw7rwvk9tb1xj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-49566 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-49566 · Security Note
• https://osv.dev/vulnerability/GHSA-7qpc-4xx9-x5qw · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05629 · Security Note
• https://github.com/apache/linkis · Note
• https://openwall.com/lists/oss-security/2024/07/13/5 · Note
• https://t.me/cvedetector/854 · Telegram Post
• https://linkis.apache.org/download/release-notes-1.6.0 · Note
• http://openwall.com/lists/oss-security/2024/07/13/5 · Note