[<prev] [day] [month] [year] [list]
Message-ID: <3a89912b-4716-3c74-fe29-288f650eaac9@apache.org>
Date: Thu, 09 Oct 2025 13:05:53 +0000
From: Leonard Xu <leonard@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-62228: Apache Flink CDC, Apache Flink CDC, Apache Flink
CDC, Apache Flink CDC, Apache Flink CDC: SQL injection via maliciously
crafted identifiers
Severity:
Affected versions:
- Apache Flink CDC (org.apache.flink:flink-connector-mysql-cdc) 3.0.0 through 3.4.0
- Apache Flink CDC (org.apache.flink:flink-connector-sqlserver-cdc) 3.0.0 through 3.4.0
- Apache Flink CDC (org.apache.flink:flink-connector-db2-cdc) 3.0.0 through 3.4.0
- Apache Flink CDC (org.apache.flink:flink-connector-oracle-cdc) 3.0.0 through 3.4.0
- Apache Flink CDC (org.apache.flink:flink-cdc-pipeline-connector-oceanbase) 3.3.0 through 3.4.0
Description:
Apache Flink CDC version 3.4.0 was vulnerable to a SQL injection via maliciously crafted identifiers eg. crafted database name or crafted table name. Even through only the logged-in database user can trigger the attack, we recommend users update Flink CDC version to 3.5.0 which address this issue.
Credit:
intSheep (reporter)
Mapta/BugBunny_ai (reporter)
References:
https://flink.apache.org/
https://www.cve.org/CVERecord?id=CVE-2025-62228
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
