CVE-2022-44644: Exposure of Sensitive Information to an Unauthorized Actor

January 31, 2023 (updated November 9, 2023)

In Apache Linkis <=1.3.0 when used with the MySQL Connector/J, an authenticated attacker could read arbitrary local file by connecting a rogue mysql server, By adding allowLoadLocalInfile to true in the jdbc parameter. Therefore, the parameters in the jdbc url should be block listed. Versions of Apache Linkis <= 1.3.0 will be affected. We recommend users upgrade the version of Linkis to version 1.3

References

github.com/advisories/GHSA-rx76-xw35-6rh8
lists.apache.org/thread/hwq9ytq6y1kdh9lz5znptkcrdll9x85h
nvd.nist.gov/vuln/detail/CVE-2022-44644

Code Behaviors & Features

Detect and mitigate CVE-2022-44644 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →