CVE-2022-26885: Insufficiently Protected Credentials

November 24, 2022 (updated December 2, 2022)

When using tasks to read config files, there is a risk of database password disclosure. We recommend you upgrade to version 2.0.6 or higher.

References

github.com/advisories/GHSA-jvc3-wjf6-7c6c
github.com/apache/dolphinscheduler/releases/tag/2.0.6
lists.apache.org/thread/z7084r9cs2r26cszkkgjqpb5bhnxqssp
nvd.nist.gov/vuln/detail/CVE-2022-26885

Code Behaviors & Features

Detect and mitigate CVE-2022-26885 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →