[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 16 Oct 2023 01:51:45 +0000
From: Charles Zhang <dockerzhang@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2023-43668: Apache InLong: Jdbc Connection Security Bypass in
InLong
Severity: important
Affected versions:
- Apache InLong 1.4.0 through 1.8.0
Description:
Authorization Bypass Through User-Controlled Key vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0,
some sensitive params checks will be bypassed, like "autoDeserizalize","allowLoadLocalInfile"....
.
Users are advised to upgrade to Apache InLong's 1.9.0 or cherry-pick [1] to solve it.
[1] https://github.com/apache/inlong/pull/8604
Credit:
nbxiglk (finder)
References:
https://inlong.apache.org
https://www.cve.org/CVERecord?id=CVE-2023-43668
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
