28 matches found
Code injection
Apache Calcite Avatica JDBC driver creates HTTP client instances based on class names provided via httpclientimpl connection property; however, the driver does not verify if the class implements the expected interface before instantiating it, which can lead to code execution loaded via arbitrary...
CVE-2022-36364 Apache Calcite Avatica JDBC driver `httpclient_impl` connection property can be used as an RCE vector
Apache Calcite Avatica JDBC driver creates HTTP client instances based on class names provided via httpclientimpl connection property; however, the driver does not verify if the class implements the expected interface before instantiating it, which can lead to code execution loaded via arbitrary...
CVE-2022-36364
Apache Calcite Avatica JDBC driver creates HTTP client instances based on class names provided via httpclientimpl connection property; however, the driver does not verify if the class implements the expected interface before instantiating it, which can lead to code execution loaded via arbitrary...
cn.benma666:druid (1.2.22), cn.guruguru:datalink (>=0.0.1, <=0.0.2) +841 more potentially affected by CVE-2022-36364 via org.apache.calcite.avatica:avatica-core (>=1.9.0, <=1.21.0)
org.apache.calcite.avatica:avatica-core MAVEN version =1.9.0, =0.0.1, =0.0.2, =1.1.2, =1.1.2, =1.3.0, =1.3.0, =1.3.1, =1.4.0, =1.3.0, =1.3.0, =1.6.2 and more Source cves: CVE-2022-36364 Source advisory: MEND:CVE-2022-36364...
CVE-2022-36364 Apache Calcite Avatica JDBC driver `httpclient_impl` connection property can be used as an RCE vector
Apache Calcite Avatica JDBC driver creates HTTP client instances based on class names provided via httpclientimpl connection property; however, the driver does not verify if the class implements the expected interface before instantiating it, which can lead to code execution loaded via arbitrary...
CVE-2022-36364
Apache Calcite Avatica JDBC driver is affected by CVE-2022-36364 due to insecure dynamic instantiation of httpclient_impl classes without validating they implement the expected interface, enabling potential code execution loaded from arbitrary classes. The issue is addressed starting with Avatica...
CVE-2022-36364: Improper Initialization
Apache Calcite Avatica JDBC driver creates HTTP client instances based on class names provided via httpclientimpl connection property; however, the driver does not verify if the class implements the expected interface before instantiating it, which can lead to code execution loaded via arbitrary...
PT-2022-4408
Name of the Vulnerable Software and Affected Versions Apache Calcite Avatica JDBC driver versions prior to 1.22.0 Description The issue is related to the creation of HTTP client instances based on class names provided via the httpclient impl connection property. The driver does not verify if the...