CVE-2023-29216: Deserialization of Untrusted Data

April 10, 2023 (updated April 13, 2023)

In Apache Linkis <=1.3.1, because the parameters are not effectively filtered, the attacker uses the MySQL data source and malicious parameters to configure a new data source to trigger a deserialization vulnerability, eventually leading to remote code execution. Versions of Apache Linkis <= 1.3.0 will be affected. We recommend users upgrade the version of Linkis to version 1.3.2.

References

www.openwall.com/lists/oss-security/2023/04/10/5
lists.apache.org/thread/18vv0m32oy51nzk8tbz13qdl5569y55l
nvd.nist.gov/vuln/detail/CVE-2023-29216

Code Behaviors & Features

Detect and mitigate CVE-2023-29216 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →