CVE-2023-29215: Deserialization of Untrusted Data

April 10, 2023 (updated April 13, 2023)

In Apache Linkis <=1.3.1, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in JDBC EengineConn Module will trigger a deserialization vulnerability and eventually lead to remote code execution. Therefore, the parameters in the Mysql JDBC URL should be block listed. Versions of Apache Linkis <= 1.3.0 will be affected. We recommend users upgrade the version of Linkis to version 1.3.2.

References

www.openwall.com/lists/oss-security/2023/04/10/4
lists.apache.org/thread/o682wz1ggq491ybvjwokxvcdtnzo76ls
nvd.nist.gov/vuln/detail/CVE-2023-29215

Code Behaviors & Features

Detect and mitigate CVE-2023-29215 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →