CVE-2023-31058 - OpenCVE

Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Attackers would bypass the 'autoDeserialize' option filtering by adding blanks. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7674 https://github.com/apache/inlong/pull/7674 to solve it.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Apache	Inlong

Configuration 1 [-]

cpe:2.3:a:apache:inlong:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://lists.apache.org/thread/bkcgbn9l61croxfyspf7xd42qb189s3z

History

No history.

MITRE

Status: PUBLISHED

Assigner: apache

Published: 2023-05-22T12:54:12.153Z

Updated: 2024-08-02T14:45:24.965Z

Reserved: 2023-04-24T02:24:37.855Z

Link: CVE-2023-31058

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2023-05-22T13:15:09.843

Modified: 2023-05-27T00:48:58.773

Link: CVE-2023-31058

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-31058", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2023-04-24T02:24:37.855Z", "datePublished": "2023-05-22T12:54:12.153Z", "dateUpdated": "2024-08-02T14:45:24.965Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Apache InLong", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "1.6.0", "status": "affected", "version": "1.4.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "sw0rd1ight of Caiji Sec Team"}, {"lang": "en", "type": "finder", "value": "4ra1n of Chaitin Tech"}, {"lang": "en", "type": "finder", "value": "H Ming"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.<p><span style=\"background-color: var(--wht);\">This issue affects Apache InLong: from 1.4.0 through 1.6.0. </span><span style=\"background-color: var(--wht);\"><span style=\"background-color: rgb(255, 255, 255);\">Attackers would bypass the\n'autoDeserialize' option filtering by a<span style=\"background-color: var(--wht);\">dding</span><span style=\"background-color: var(--wht);\"><span style=\"background-color: rgb(255, 255, 255);\"> blanks</span></span></span>. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick <a target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/apache/inlong/pull/7674\">\n\n</a><a target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/apache/inlong/pull/7674\">https://github.com/apache/inlong/pull/7674</a> to solve it.</span></p>"}], "value": "Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Attackers would bypass the\n'autoDeserialize' option filtering by adding\u00a0blanks. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick\u00a0\n\n https://github.com/apache/inlong/pull/7674 https://github.com/apache/inlong/pull/7674 to solve it.\n\n"}], "metrics": [{"other": {"content": {"text": "moderate"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2023-05-22T15:48:36.078Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/bkcgbn9l61croxfyspf7xd42qb189s3z"}], "source": {"discovery": "UNKNOWN"}, "title": "Apache InLong: JDBC URL bypassing by adding blanks", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T14:45:24.965Z"}, "title": "CVE Program Container", "references": [{"tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.apache.org/thread/bkcgbn9l61croxfyspf7xd42qb189s3z"}]}]}}