CVE-2023-29216: Apache Linkis DatasourceManager module has deserialization vulnerability

April 10, 2023 (updated February 13, 2025)

In Apache Linkis <=1.3.1, because the parameters are not effectively filtered, the attacker can use the MySQL data source and malicious parameters to configure a new data source to trigger a deserialization vulnerability, eventually leading to remote code execution. Users should upgrade their version of Linkis to version 1.3.2.

References

github.com/advisories/GHSA-rrhf-32rq-f28h
github.com/apache/linkis
linkis.apache.org/download/release-notes-1.3.2
lists.apache.org/thread/18vv0m32oy51nzk8tbz13qdl5569y55l
nvd.nist.gov/vuln/detail/CVE-2023-29216

Code Behaviors & Features

Detect and mitigate CVE-2023-29216 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →