org.apache.kylin:kylin-engine-build-sdk (>=5.0.0-alpha, <=5.0.2), org.apache.ranger:ranger-kylin-plugin (>=2.5.0, <=2.9.0) +1 more potentially affected by CVE-2025-61735 via org.apache.kylin:kylin-core-common (>=4.0.4, <=5.0.2)

org.apache.kylin:kylin-core-common MAVEN version =4.0.4, =5.0.0-alpha, =2.5.0, =2.5.0, =2.9.0 Source cves: CVE-2025-61735 Source advisory: GHSA-F6M8-QM7J-FH65...

org.apache.kylin:kylin-engine-build-sdk (>=5.0.0-alpha, <=5.0.2), org.apache.ranger:ranger-kylin-plugin (>=2.5.0, <=2.9.0) +1 more potentially affected by CVE-2025-61733 via org.apache.kylin:kylin-core-common (>=4.0.4, <=5.0.2)

org.apache.kylin:kylin-core-common MAVEN version =4.0.4, =5.0.0-alpha, =2.5.0, =2.5.0, =2.9.0 Source cves: CVE-2025-61733 Source advisory: GHSA-MR9J-4J48-XCM2...

org.apache.kylin:kylin-engine-build-sdk (>=5.0.0-alpha, <=5.0.2), org.apache.ranger:ranger-kylin-plugin (>=2.5.0, <=2.9.0) +1 more potentially affected by CVE-2025-61734 via org.apache.kylin:kylin-core-common (>=4.0.4, <=5.0.2)

org.apache.kylin:kylin-core-common MAVEN version =4.0.4, =5.0.0-alpha, =2.5.0, =2.5.0, =2.9.0 Source cves: CVE-2025-61734 Source advisory: SNYK:JAVA-ORGAPACHEKYLIN-13181860...

org.apache.kylin:kylin-engine-build-sdk (>=5.0.0-alpha, <=5.0.2), org.apache.ranger:ranger-kylin-plugin (>=2.5.0, <=2.9.0) +1 more potentially affected by CVE-2025-61734 via org.apache.kylin:kylin-core-common (>=4.0.4, <=5.0.2)

org.apache.kylin:kylin-core-common MAVEN version =4.0.4, =5.0.0-alpha, =2.5.0, =2.5.0, =2.9.0 Source cves: CVE-2025-61734 Source advisory: GHSA-P86W-W5RH-M3HX...

org.apache.kylin:kylin-engine-build-sdk (>=5.0.0-alpha, <=5.0.2), org.apache.ranger:ranger-kylin-plugin (>=2.5.0, <=2.9.0) +1 more potentially affected by CVE-2025-61735 via org.apache.kylin:kylin-core-common (>=4.0.4, <=5.0.2)

org.apache.kylin:kylin-core-common MAVEN version =4.0.4, =5.0.0-alpha, =2.5.0, =2.5.0, =2.9.0 Source cves: CVE-2025-61735 Source advisory: MEND:CVE-2025-61735...

org.apache.kylin:kylin-engine-build-sdk (>=5.0.0-alpha, <=5.0.2), org.apache.ranger:ranger-kylin-plugin (>=2.5.0, <=2.9.0) +1 more potentially affected by CVE-2025-61733 via org.apache.kylin:kylin-core-common (>=4.0.4, <=5.0.2)

org.apache.kylin:kylin-core-common MAVEN version =4.0.4, =5.0.0-alpha, =2.5.0, =2.5.0, =2.9.0 Source cves: CVE-2025-61733 Source advisory: MEND:CVE-2025-61733...

org.apache.kylin:kylin-engine-build-sdk (>=5.0.0-alpha, <=5.0.2), org.apache.ranger:ranger-kylin-plugin (>=2.5.0, <=2.9.0) +1 more potentially affected by CVE-2025-61734 via org.apache.kylin:kylin-core-common (>=4.0.4, <=5.0.2)

org.apache.kylin:kylin-core-common MAVEN version =4.0.4, =5.0.0-alpha, =2.5.0, =2.5.0, =2.9.0 Source cves: CVE-2025-61734 Source advisory: MEND:CVE-2025-61734...

CVE-2022-43396

In the fix for CVE-2022-24697, a blacklist is used to filter user input commands. But there is a risk of being bypassed. The user can control the command by controlling the kylin.engine.spark-cmd parameter of conf...

CVE-2022-43396: Incomplete List of Disallowed Inputs

In the fix for CVE-2022-24697, a blacklist is used to filter user input commands. But there is a risk of being bypassed. The user can control the command by controlling the kylin.engine.spark-cmd parameter of conf...

Man-in-the-middle (MitM)

kylin-engine-mr is vulnerable to man-in-the-middle MitM attack. It is possible because it uses insecure TLS in the function createEasySSLContext in DefaultSslProtocolSocketFactory.java, allowing a man-in-the-middle to intercept the connection...