CVE-2023-29215: Apache Linkis JDBC EngineConn has deserialization vulnerability

April 10, 2023 (updated February 13, 2025)

In Apache Linkis <=1.3.1, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in JDBC EengineConn Module will trigger a deserialization vulnerability and eventually lead to remote code execution. Therefore, the parameters in the Mysql JDBC URL should be block listed. Versions of Apache Linkis <= 1.3.0 will be affected. We recommend users upgrade the version of Linkis to version 1.3.2.

References

github.com/advisories/GHSA-qm2h-m799-86rc
github.com/apache/linkis
github.com/apache/linkis/commit/7005c01d7f7bca78322447f4f2f32b8398645687
linkis.apache.org/download/release-notes-1.3.2
lists.apache.org/thread/o682wz1ggq491ybvjwokxvcdtnzo76ls
nvd.nist.gov/vuln/detail/CVE-2023-29215

Code Behaviors & Features

Detect and mitigate CVE-2023-29215 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →