CVE-2023-31058: Deserialization of Untrusted Data

July 6, 2023

Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Attackers would bypass the ‘autoDeserialize’ option filtering by adding blanks. Users are advised to upgrade to Apache InLong’s 1.7.0 or cherry-pick

https://github.com/apache/inlong/pull/7674 https://github.com/apache/inlong/pull/7674 to solve it.

References

github.com/advisories/GHSA-c3rh-f2w5-fghm
github.com/apache/inlong/pull/7674
lists.apache.org/thread/bkcgbn9l61croxfyspf7xd42qb189s3z
nvd.nist.gov/vuln/detail/CVE-2023-31058

Code Behaviors & Features

Detect and mitigate CVE-2023-31058 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →