AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

linkisGHSA-m757-p8rv-4q93

Apache Linkis DataSource: DataSource module Oracle SQL Database Password Logged

linkis

CVE-2023-50740 · Published Mar 6, 2024 · updated Feb 13, 2025

Medium5.3
Fix: upgrade to 1.5.0 or later
GitHub advisory

In Apache Linkis <=1.4.0, The password is printed to the log when using the Oracle data source of the Linkis data source module. 

We recommend users upgrade the version of Linkis to version 1.5.0

Affected versions

PackageAffectedFixed in
org.apache.linkis:linkis
Maven
< 1.5.01.5.0
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-532
Also known as
CVE-2023-50740

More linkis advisories

All linkis
High 5.3Aug 2, 2024Apache Linkis vulnerable to privilege escalationCVE-2024-27181fixed in 1.6.0High 4.9Aug 2, 2024Apache Linkis arbitrary file deletion vulnerabilityCVE-2024-27182fixed in 1.6.0Critical 9.1Jul 6, 2023Apache Linkis Authentication Bypass vulnerabilityCVE-2023-27987fixed in 1.3.2Critical 9.8Jul 6, 2023Apache Linkis Zip Slip issueCVE-2023-27603fixed in 1.3.2Critical 9.8Jul 6, 2023Apache Linkis Unrestricted File Upload vulnerabilityCVE-2023-27602fixed in 1.3.2High 8.8Jan 31, 2023Apache Linkis contains Deserialization of Untrusted DataCVE-2022-44645fixed in 1.3.1