org.apache.kylin:kylin-tool-assembly (>=2.1.0 <=3.0.2), org.apache.ranger:ranger-kylin-plugin (>=1.1.0 <=2.2.0) +1 more potentially affected by CVE-2020-13926 via org.apache.kylin:kylin-server-base (>=2.1.0 <=3.0.2)

org.apache.kylin:kylin-server-base MAVEN version =2.1.0, =2.1.0, =1.1.0, =1.1.0, =2.2.0 Source cves: CVE-2020-13926 Source advisory: OSV:GHSA-HX5G-8HQ2-8X4W...

CVE-2020-13926

Kylin concatenates and executes a Hive SQL in Hive CLI or beeline when building a new segment; some part of the HQL is from system configurations, while the configuration can be overwritten by certain rest api, which makes SQL injection attack is possible. Users of all previous versions after 2.0...

CVE-2020-13926

Kylin is susceptible to SQL injection in the segment-building process. The vulnerability arises because Hive SQL (HQL) used during segment creation is assembled from a mix of system configurations and user-overwritable REST API inputs, allowing an attacker to inject and execute arbitrary SQL stat...