Lucene search
GitHub Advisory DatabaseGHSA-6GCH-63WP-4V5FHistorySep 25, 2024 - 3:30 a.m.
Apache Linkis Spark EngineConn: Commons Lang's RandomStringUtils Random string security vulnerability
2024-09-2503:30:35
CWE-326
GitHub Advisory Database
github.com
apache linkis
spark engineconn
random string
security vulnerability
commons lang's
randomstringutils
upgrade
version 1.6.0
fix
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
AI Score
7.1
Confidence
High
In Apache Linkis <= 1.5.0, a Random string security vulnerability in Spark EngineConn, random string generated by the Token when starting Py4j uses the Commons Lang’s RandomStringUtils.
Users are recommended to upgrade to version 1.6.0, which fixes this issue.
Affected configurations
Node
org.apache.linkislinkis-engineplugin-sparkRange<1.6.0
| Vendor | Product | Version | CPE |
|---|---|---|---|
| org.apache.linkis | linkis-engineplugin-spark | * | cpe:2.3:a:org.apache.linkis:linkis-engineplugin-spark:*:*:*:*:*:*:*:* |
Related
nvd
nvd
CVE-2024-39928
2024-09-25 01:15:40
cve
cve
CVE-2024-39928
2024-09-25 01:15:40
cvelist
cvelist
vulnrichment
vulnrichment
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
AI Score
7.1
Confidence
High
Related for GHSA-6GCH-63WP-4V5F