CVE-2023-31058 Apache InLong: JDBC URL bypassing by adding blanks

2023-05-2212:54:12

CWE-502

apache

www.cve.org

cve-2023-31058

apache inlong

jdbc url bypassing

untrusted data vulnerability

apache software foundation

upgrade

autodeserialize option.

0.002 Low

EPSS

Percentile

53.6%

JSON

Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Attackers would bypass the
‘autoDeserialize’ option filtering by adding blanks. Users are advised to upgrade to Apache InLong’s 1.7.0 or cherry-pick

https://github.com/apache/inlong/pull/7674 https://github.com/apache/inlong/pull/7674 to solve it.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache InLong",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "1.6.0",
        "status": "affected",
        "version": "1.4.0",
        "versionType": "semver"
      }
    ]
  }
]

References

lists.apache.org/thread/bkcgbn9l61croxfyspf7xd42qb189s3z

0.002 Low

EPSS

Percentile

53.6%

JSON

Related for CVELIST:CVE-2023-31058