CVE-2024-36268: Apache Inlong Code Injection vulnerability

August 2, 2024

Improper Control of Generation of Code (‘Code Injection’) vulnerability in Apache InLong.

This issue affects Apache InLong: from 1.10.0 through 1.12.0, which could lead to Remote Code Execution. Users are advised to upgrade to Apache InLong’s 1.13.0 or cherry-pick [1] to solve it.

[1] https://github.com/apache/inlong/pull/10251

References

github.com/advisories/GHSA-qff2-8qw7-hcvw
github.com/apache/inlong/commit/85fc8b02e69badc5103fadb77559a921c788537a
github.com/apache/inlong/pull/10251
lists.apache.org/thread/1w1yp1bg5sjvn46dszkf00tz1vfs0frc
nvd.nist.gov/vuln/detail/CVE-2024-36268

Code Behaviors & Features

Detect and mitigate CVE-2024-36268 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →