PT-2025-23053 · Apache · Apache Inlong

H3H3Qaq + 1 · Published 2025-02-11 · Updated 2025-06-02 · CVE-2025-27528

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache InLong versions 1.13.0 through 2.1.0

Description The issue affects Apache InLong, allowing attackers to bypass its security mechanisms and enabling arbitrary file reading due to a deserialization of untrusted data vulnerability.

Recommendations For Apache InLong versions 1.13.0 through 2.1.0, update to version 2.2.0 to resolve the issue. Alternatively, users can cherry-pick the solution from the provided GitHub pull request.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2025-06400

CVE-2025-27528

GHSA-98V7-XXXV-HCRH

Affected Products

Apache Inlong

References · 16

• https://github.com/apache/inlong/pull/11747 · Patch
• https://osv.dev/vulnerability/CVE-2025-27528 · Vendor Advisory
• https://lists.apache.org/thread/b807rqzgyv4qgvxw3nhkq8tl6g90gqgj · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-06400 · Security Note
• https://osv.dev/vulnerability/GHSA-98v7-xxxv-hcrh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27528 · Security Note
• https://github.com/apache/inlong · Note
• https://t.me/cvetracker/24804 · Telegram Post
• https://twitter.com/CVEnew/status/1927648256017743986 · Twitter Post
• https://twitter.com/oss_security/status/1927569123740967381 · Twitter Post
• https://twitter.com/cybercronai/status/1927911601610350972 · Twitter Post
• https://t.me/cvenotify/123806 · Telegram Post
• https://openwall.com/lists/oss-security/2025/05/28/3 · Note
• https://twitter.com/superstubbs/status/1927951845210706428 · Twitter Post
• http://openwall.com/lists/oss-security/2025/05/28/3 · Note