PT-2025-9062 · Apache · Apache Inlong

Ming · Published 2025-02-28 · Updated 2025-06-23 · CVE-2025-27531

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache InLong versions 1.13.0 through 2.1.0

Description The issue concerns a deserialization of untrusted data, allowing for an arbitrary file read vulnerability. This can be exploited by bypassing security measures through double writing of a parameter.

Recommendations For Apache InLong versions 1.13.0 through 2.1.0, consider restricting access to untrusted data deserialization until a patch is available. As a temporary workaround, avoid using the vulnerable JDBC functionality to minimize the risk of exploitation.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-27531

GHSA-62GC-8JR5-X9PM

Affected Products

Apache Inlong

References · 14

• http://openwall.com/lists/oss-security/2025/02/28/2 · Vendor Advisory
• https://lists.apache.org/thread/r62lkqrr739wvcb60j6ql6q63rh4bxx5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-27531 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-62gc-8jr5-x9pm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27531 · Security Note
• https://github.com/apache/inlong/pull/11586 · Note
• https://github.com/apache/inlong · Note
• https://github.com/apache/inlong/commit/ebcd6d3230b73abdc41edb93619be2a26c9b8c97 · Note
• https://github.com/apache/inlong/issues/11585 · Note
• https://twitter.com/CVEnew/status/1931037270842245580 · Twitter Post
• https://twitter.com/oss_security/status/1895328012859834472 · Twitter Post
• https://t.me/cvetracker/25632 · Telegram Post
• https://t.me/cvenotify/125070 · Telegram Post
• https://t.me/cvenotify/126383 · Telegram Post