Directory Traversal

flink-runtime in vulnerable to Directory Traversal. An attacker is able to read any file accessible by the JobManager process on the local filesystem of the JobManager through the RES interface of the JobManager process...

com.alibaba.alink:alink_connector_datahub_flink-1.11_2.11 (>=1.5.5, <=1.6.2), com.alibaba.alink:alink_connector_kafka_flink-1.11_2.11 (>=1.4.0, <=1.6.2) +96 more potentially affected by CVE-2020-17519 via org.apache.flink:flink-runtime_2.11 (>=1.11.0, <=1.11.2)

org.apache.flink:flink-runtime2.11 MAVEN version =1.11.0, =1.5.5, =1.4.0, =1.6.2 - com.alibaba.alink:alinkconnectorshiveflink-1.102.11 1.2.0 - com.alibaba.alink:alinkconnectorshiveflink-1.112.11 1.2.0 - com.alibaba.alink:alinkconnectorshiveflink-1.92.11 1.2.0 -...

Arbitrary File Write

flink-runtime is vulnerable to arbitrary file write. The vulnerability exists as files can be written to any accessible location through the modified value of HTTP HEADER...

com.alibaba.alink:alink_connector_datahub_flink-1.11_2.11 (>=1.5.5, <=1.6.2), com.alibaba.alink:alink_connector_kafka_flink-1.11_2.11 (>=1.4.0, <=1.6.2) +96 more potentially affected by CVE-2020-17519 via org.apache.flink:flink-runtime_2.11 (>=1.11.0, <=1.11.2)

org.apache.flink:flink-runtime2.11 MAVEN version =1.11.0, =1.5.5, =1.4.0, =1.6.2 - com.alibaba.alink:alinkconnectorshiveflink-1.102.11 1.2.0 - com.alibaba.alink:alinkconnectorshiveflink-1.112.11 1.2.0 - com.alibaba.alink:alinkconnectorshiveflink-1.92.11 1.2.0 -...

Information Disclosure Via Checkpoint Directory Permission

flink-runtime is vulnerable to information disclosure. The vulnerability can happen because it creates checkpoint directory without specified permission, allowing another user to delete or read files under it. Therefore it can cause restore failure or information disclosure...