linkisGHSA-pj5j-w7mw-w797

Apache Linkis Zip Slip issue

CVE-2023-27603 · Published Jul 6, 2023 · updated Oct 22, 2024

Critical9.8

Fix: upgrade to 1.3.2 or later

In Apache Linkis <=1.3.1, due to the Manager module engineConn material upload does not check the zip path, This is a Zip Slip issue, which will lead to a potential RCE vulnerability.

We recommend users upgrade the version of Linkis to version 1.3.2.

Affected versions

Package	Affected	Fixed in
org.apache.linkis:linkis Maven	< 1.3.2	1.3.2

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity from: GitHub (reviewed advisory)
Weakness: CWE-22, CWE-434
Also known as: CVE-2023-27603

More linkis advisories

All linkis

Medium 5.3Mar 6, 2024

Apache Linkis DataSource: DataSource module Oracle SQL Database Password LoggedCVE-2023-50740fixed in 1.5.0 Critical 9.1Jul 6, 2023

Apache Linkis Authentication Bypass vulnerabilityCVE-2023-27987fixed in 1.3.2 Critical 9.8Jul 6, 2023

Apache Linkis Unrestricted File Upload vulnerabilityCVE-2023-27602fixed in 1.3.2 High 8.8Jan 31, 2023

Apache Linkis contains Deserialization of Untrusted DataCVE-2022-44645fixed in 1.3.1 Medium 6.5Jan 31, 2023

Apache Linkis vulnerable to Exposure of Sensitive InformationCVE-2022-44644fixed in 1.3.1 High 8.8Oct 26, 2022

Apache Linkis subject to Remote Code Execution via deserializationCVE-2022-39944fixed in 1.3.0