Lucene search
HistorySep 25, 2024 - 1:15 a.m.
CVE-2024-39928
apache linkis
spark engineconn
randomstringutils
token
py4j
commons lang
upgrade
version 1.6.0
cve-2024-39928
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
0
Percentile
9.6%
In Apache Linkis <= 1.5.0, a Random string security vulnerability in Spark EngineConn, random string generated by the Token when starting Py4j uses the Commons Lang’s RandomStringUtils.
Users are recommended to upgrade to version 1.6.0, which fixes this issue.
Related
cve
cve
CVE-2024-39928
2024-09-25 01:15:40
cvelist
cvelist
vulnrichment
vulnrichment
osv
osv
github
github
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
0
Percentile
9.6%
Related for NVD:CVE-2024-39928