oss-security - CVE-2023-31058: Apache InLong: JDBC URL bypassing by adding blanks

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Date: Sun, 21 May 2023 08:10:52 +0000
From: Charles Zhang <dockerzhang@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2023-31058: Apache InLong: JDBC URL bypassing by adding blanks

Severity: moderate

Affected versions:

- Apache InLong 1.4.0 through 1.6.0

Description:

Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Attackers would bypass the
'autoDeserialize' option filtering by adding blanks.  Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick [1] to solve it.

[1] 

 https://github.com/apache/inlong/pull/7674 https://github.com/apache/inlong/pull/7674

Credit:

H Ming (finder)

References:

https://inlong.apache.org
https://www.cve.org/CVERecord?id=CVE-2023-31058

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.