K14234227: Apache DB DdlUtils vulnerability CVE-2021-41616

Security Advisory Description Apache DB DdlUtils 1.0 included a BinaryObjectsHelper that was intended for use when migrating database data with a SQL data type of BINARY, VARBINARY, LONGVARBINARY, or BLOB between databases using the ddlutils features. The BinaryObjectsHelper class was insecure an...

com.alibaba.otter:canal.example (>=1.1.0 <=1.1.4), com.alibaba.otter:manager.biz (>=4.2.1 <=4.2.15) +69 more potentially affected by CVE-2021-41616 via org.apache.ddlutils:ddlutils (=1.0)

org.apache.ddlutils:ddlutils MAVEN version =1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.ddlutils:ddlutils and may be impacted: - com.alibaba.otter:canal.example =1.1.0, =4.2.1, =4.2.1, =4.2.1, =4.2.1, =4.2.1, =4.2.1, =4.2.1, =4.2.1,...

CVE-2021-41616

CVE-2021-41616 concerns Apache DB DdlUtils 1.0, where the BinaryObjectsHelper deserializes data via ObjectInputStream.readObject without validating input. This insecure deserialization could lead to arbitrary code execution. Multiple sources (NVD, OSV, CNVD) describe the root cause as the untrust...