AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

kylinGHSA-5429-pjww-7675

SQL Injection in Apache Kylin

kylin

CVE-2021-36774 · Published Jan 8, 2022 · updated Feb 16, 2024

Medium6.5
Fix: upgrade to 3.1.3 or later
GitHub advisory

Apache Kylin allows users to read data from other database systems using JDBC. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker to execute arbitrary code from a hacker-controlled malicious MySQL server within Kylin server processes. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions.

Affected versions

PackageAffectedFixed in
org.apache.kylin:kylin
Maven
< 3.1.33.1.3
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-668, CWE-89
Also known as
CVE-2021-36774

More kylin advisories

All kylin
Medium 5.3Feb 10, 2022Authentication bypass in Apache KylinCVE-2020-13937fixed in 3.1.1 +1High 7.5Jan 8, 2022In Apache Kylin, Cross-origin requests with credentials are allowed to be sent from any originCVE-2021-45457fixed in 3.1.3 +1High 7.5Jan 8, 2022Use of Hard-coded Credentials in Apache KylinCVE-2021-45458fixed in 3.1.3 +1MediumJan 8, 2022Server-Side Request Forgery in Apache KylinCVE-2021-27738fixed in 3.1.3MediumJan 8, 2022Kylin can receive user input and load any class through Class.forName(...)CVE-2021-31522fixed in 3.1.3 +1MediumJan 8, 2022Command Injection in Apache KylinCVE-2021-45456fixed in 4.0.1