CVE-2023-29215 Apache Linkis JDBC EngineCon has a deserialization command execution

2023-04-1007:35:23

CWE-502

apache

www.cve.org

apache linkis

jdbc enginecon

deserialization

command execution

filtering

parameters

mysql

jdbc

vulnerability

remote code execution

blacklisting

upgrade

AI Score

Confidence

High

EPSS

0.024

Percentile

89.9%

JSON

In Apache Linkis <=1.3.1, due to the lack of effective filtering
of parameters, an attacker configuring malicious Mysql JDBC parameters in JDBC EengineConn Module will trigger a
deserialization vulnerability and eventually lead to remote code execution. Therefore, the parameters in the Mysql JDBC URL should be blacklisted. Versions of Apache Linkis <= 1.3.0 will be affected.
We recommend users upgrade the version of Linkis to version 1.3.2.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache Linkis",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "1.3.1",
        "status": "affected",
        "version": "0",
        "versionType": "maven"
      }
    ]
  }
]