CVE-2023-34434: JDBC URL bypassing by allowLoadLocalInfileInPath param

July 25, 2023 (updated February 13, 2025)

Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0.

The attacker could bypass the current logic and achieve arbitrary file reading. To solve it, users are advised to upgrade to Apache InLong’s 1.8.0 or cherry-pick https://github.com/apache/inlong/pull/8130 .

References

github.com/advisories/GHSA-pq67-9jf9-hc3c
github.com/apache/inlong
github.com/apache/inlong/commit/34835f827771074345f42a9b1658d018f202516e
github.com/apache/inlong/pull/8130
lists.apache.org/thread/7f1o71w5r732cspltmtdydn01gllf4jo
nvd.nist.gov/vuln/detail/CVE-2023-34434

Code Behaviors & Features

Detect and mitigate CVE-2023-34434 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →