com.webank.wedatasphere.linkis:linkis-engineplugin-hive (1.0.2), org.apache.hive:hive-pre-upgrade (>=4.0.0-alpha-2, <=4.0.0-beta-1) +3 more potentially affected by CVE-2024-29869 via org.apache.hive:hive-exec (2.3.3)

org.apache.hive:hive-exec MAVEN version 2.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - com.webank.wedatasphere.linkis:linkis-engineplugin-hive 1.0.2 - org.apache.hive:hive-pre-upgrade...

com.webank.wedatasphere.linkis:linkis-engineplugin-hive (1.0.2), org.apache.hive:hive-llap-client (2.3.3) +5 more potentially affected by CVE-2024-23953 via org.apache.hive:hive-llap-common (2.3.3)

org.apache.hive:hive-llap-common MAVEN version 2.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-llap-common and may be impacted: - com.webank.wedatasphere.linkis:linkis-engineplugin-hive 1.0.2 - org.apache.hive:hive-llap-clien...

Arbitrary File Read

org.apache.linkis, linkis-metadata-query-service-jdbc is vulnerable to Arbitrary File Read. The vulnerability is due to insufficient parameter filtering in the DataSource Manager Module, allowing an attacker to configure malicious MySQL JDBC parameters to read arbitrary files from the server...

GHSA-8CVQ-3JJP-PH9P Apache Linkis Metadata Query Service JDBC: JDBC Datasource Module with Mysql has file read vulnerability

Affected versions: - Apache Linkis Metadata Query Service JDBC 1.5.0 before 1.7.0 Description: In Apache Linkis 1.7.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manager Module will allow the attacker to read...

Apache Linkis Metadata Query Service JDBC: JDBC Datasource Module with Mysql has file read vulnerability

Affected versions: - Apache Linkis Metadata Query Service JDBC 1.5.0 before 1.7.0 Description: In Apache Linkis 1.7.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manager Module will allow the attacker to read...

CVE-2024-45627 Apache Linkis Metadata Query Service JDBC: JDBC Datasource Module with Mysql has file read vulnerability

In Apache Linkis 1.7.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manager Module will allow the attacker to read arbitrary files from the Linkis server. Therefore, the parameters in the Mysql JDBC URL should be...

CVE-2024-45627

Apache Linkis, specifically the Metadata Query Service JDBC component, is vulnerable to an Arbitrary File Read vulnerability in versions prior to 1.7.0 . The root cause is an input validation error resulting from a lack of effective filtering of parameters within the DataSource Manager Module . A...