CVE-2023-51785: Apache InLong Manager Arbitrary File Read Vulnerability

January 3, 2024 (updated February 13, 2025)

Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.7.0 through 1.9.0, the attackers can make a arbitrary file read attack using mysql driver. Users are advised to upgrade to Apache InLong’s 1.10.0 or cherry-pick [1] to solve it.

[1] https://github.com/apache/inlong/pull/9331

References

github.com/advisories/GHSA-crwj-2r3c-gx2g
github.com/apache/inlong
github.com/apache/inlong/commit/d674bfe28416aff728eabafc1f6b8bb9ba5a5b8e
github.com/apache/inlong/pull/9331
lists.apache.org/thread/g0yjmtjqvp8bnf1j0tdsk0nhfozjdjno
nvd.nist.gov/vuln/detail/CVE-2023-51785

Code Behaviors & Features

Detect and mitigate CVE-2023-51785 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →