Apache InLong vulnerable to JDBC Deserialization of Untrusted Data
High severity
GitHub Reviewed
Published
Mar 27, 2023
to the GitHub Advisory Database
•
Updated Mar 31, 2023
Package
Affected versions
>= 1.1.0, < 1.6.0
Patched versions
1.6.0
Description
Published by the National Vulnerability Database
Mar 27, 2023
Published to the GitHub Advisory Database
Mar 27, 2023
Reviewed
Mar 27, 2023
Last updated
Mar 31, 2023
Apache InLong versions from 1.1.0 through 1.5.0 are vulnerable to Java Database Connectivity (JDBC) deserialization of untrusted data from the MySQL JDBC URL in MySQLDataNode. It could be triggered by authenticated users of InLong. This has been patched in version 1.6.0. Users are advised to upgrade to Apache InLong's latest version or cherry-pick the patch to solve it.
References