PT-2025-38624 · Apache · Apache Linkis

Kinghao + 2 · Published 2025-09-19 · Updated 2026-01-19 · CVE-2025-59355

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Linkis versions 1.0.0 through 1.7.0

Description A flaw exists where the decode() function within org.apache.linkis.metadata.util.HiveUtils does not properly handle Base64 decoding failures. When decoding fails, the complete input parameter, which may contain sensitive information like Hive Metastore keys or plaintext passwords, is logged at the error level. This can lead to information leakage if log files are accessible to unauthorized users. The probability of Base64 decoding failure is low, and the leakage is only triggered when error-level logs are exposed.

Recommendations Upgrade to Apache Linkis version 1.8.0 or later, which replaces the logging of the input parameter with desensitized content.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2025-59355

GHSA-6VFR-P2HX-6V32

Affected Products

Apache Linkis

References · 9

• https://lists.apache.org/thread/4dcgmqdkk2p5y4k43ok5rgd4ylx8698h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59355 · Security Note
• https://osv.dev/vulnerability/CVE-2025-59355 · Vendor Advisory
• https://lists.apache.org/thread/75z7vhftw6w1mllndgpkfmcj0fzo4lbj · Patch
• https://osv.dev/vulnerability/GHSA-6vfr-p2hx-6v32 · Vendor Advisory
• https://github.com/apache/linkis · Note
• https://twitter.com/oss_security/status/1969089149161418955 · Twitter Post
• http://openwall.com/lists/oss-security/2025/09/19/1 · Note
• https://twitter.com/CVEnew/status/2013173938625626538 · Twitter Post