Lucene search

China National Vulnerability DatabaseCNVD-2023-96664

HistoryNov 22, 2023 - 12:00 a.m.

Apache Submarine Deserialization Vulnerability

2023-11-2200:00:00

China National Vulnerability Database

www.cnvd.org.cn

apache submarine

cloud-native

machine learning

deserialization vulnerability

snakeyaml

serialized data

user submission

code execution

attacker

7.2 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

58.5%

JSON

Apache Submarine is a cloud-native machine learning platform from the Apache (USA) Foundation. Apache Submarine suffers from a deserialization vulnerability that stems from unsafe deserialization processing by snakeyaml when receiving serialized data submitted by a user, which can be exploited by an attacker to cause code execution.

CPENameOperatorVersion
apache submarine >=0.7.0，lt0.8.0

CPE	Name	Operator	Version
	apache submarine >=0.7.0，	lt	0.8.0