Apache Drill code-related vulnerabilities

Apache Drill is an open source software framework from the American company Apache Apache. Apache Drill 1.19.0 and earlier versions suffer from an XML external entity injection vulnerability that can be exploited by an attacker to read any file on a remote file system or execute commands through ...

Arbitrary File Read

apache-airflow-providers-apache-drill is vulnerable to Arbitrary File Read. The vulnerability exists because the getconn function of drill.py allows database URL's with unescaped parameters allowing an attacker to read arbitrary files when establishing a connection with the DrillHook...

apache-airflow-providers-apache-drill Improper Input Validation vulnerability

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider. Apache Airflow Drill Provider is affected by a vulnerability that allows an attacker to pass in malicious parameters when establishing a connection with DrillHook giving an opportunity to read fil...

Improper Input Validation

apache-airflow-providers-apache-drill is vulnerable to Improper Input Validation. The vulnerability exists because the getconn function of drill.py does not properly sanitize invalid characters when the host passes through the drill connection...

CVE-2023-28707 Airflow Apache Drill Provider Arbitrary File Read Vulnerability

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider.This issue affects Apache Airflow Drill Provider: before 2.3.2...

SUSE CVE-2020-14060

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool aka apache/drill...

GHSA-XP4G-5XJ6-6VPR Apache Drill vulnerable to Cross-site Scripting

In Apache Drill 1.11.0 and earlier, when submitting form from Query page, users are able to pass arbitrary script or HTML which will take effect on Profile page afterwards. Example: after submitting special script that returns cookie information from Query page, malicious user may obtain this...

Apache Drill vulnerable to Cross-site Scripting

In Apache Drill 1.11.0 and earlier, when submitting form from Query page, users are able to pass arbitrary script or HTML which will take effect on Profile page afterwards. Example: after submitting special script that returns cookie information from Query page, malicious user may obtain this...

org.apache.drill.contrib.storage-hive:drill-storage-hive-core (>=1.3.0, <=1.8.0), org.apache.drill.contrib:drill-gis (>=1.3.0, <=1.11.0) +12 more potentially affected by CVE-2017-12630 via org.apache.drill:drill-common (>=1.2.0, <=1.11.0)

org.apache.drill:drill-common MAVEN version =1.2.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.9.0, =1.3.0, =1.9.0, =1.2.0, =1.4.0, =1.4.0, =1.5.0, =1.4.0, =1.11.0 Source cves: CVE-2017-12630 Source advisory: GHSA-XP4G-5XJ6-6VPR...

org.apache.drill.contrib.storage-hive:drill-storage-hive-core (>=1.3.0, <=1.8.0), org.apache.drill.contrib:drill-gis (>=1.3.0, <=1.11.0) +12 more potentially affected by CVE-2017-12630 via org.apache.drill:drill-common (>=1.2.0, <=1.11.0)

org.apache.drill:drill-common MAVEN version =1.2.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.9.0, =1.3.0, =1.9.0, =1.2.0, =1.4.0, =1.4.0, =1.5.0, =1.4.0, =1.11.0 Source cves: CVE-2017-12630 Source advisory: OSV:GHSA-XP4G-5XJ6-6VPR...

GHSA-J823-4QCH-3RGM Deserialization of untrusted data in Jackson Databind

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool aka apache/drill...

Remote Code Execution

jackson-databind is vulnerable to remote code execution. It was possible to use the apache-drill gadget type as a serialization gadget through polymorphic typing and execute arbitrary code on the system...

CVE-2020-14060

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool aka apache/drill...

DEBIAN-CVE-2020-14060

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool aka apache/drill...

CVE-2020-14060

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool aka apache/drill...

CVE-2020-14060

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool aka apache/drill...

CVE-2020-14060

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool aka apache/drill...

CVE-2020-14060

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool aka apache/drill...

CVE-2020-14060

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool aka apache/drill...

CVE-2020-14060: Deserialization of Untrusted Data

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool aka apache/drill...