linkisGHSA-rx76-xw35-6rh8

Apache Linkis vulnerable to Exposure of Sensitive Information

CVE-2022-44644 · Published Jan 31, 2023 · updated Nov 8, 2023

Medium6.5

Fix: upgrade to 1.3.1 or later

In Apache Linkis <=1.3.0 when used with the MySQL Connector/J, an authenticated attacker could read arbitrary local file by connecting a rogue mysql server, By adding allowLoadLocalInfile to true in the jdbc parameter. Therefore, the parameters in the jdbc url should be blacklisted. Versions of Apache Linkis <= 1.3.0 will be affected. We recommend users upgrade the version of Linkis to version 1.3.1

Affected versions

Package	Affected	Fixed in
org.apache.linkis:linkis Maven	< 1.3.1	1.3.1

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity from: GitHub (reviewed advisory)
Weakness: CWE-20, CWE-200, CWE-312
Also known as: CVE-2022-44644

More linkis advisories

All linkis

Medium 5.3Mar 6, 2024

Apache Linkis DataSource: DataSource module Oracle SQL Database Password LoggedCVE-2023-50740fixed in 1.5.0 Critical 9.8Jul 6, 2023

Apache Linkis Unrestricted File Upload vulnerabilityCVE-2023-27602fixed in 1.3.2 Critical 9.8Jul 6, 2023

Apache Linkis Zip Slip issueCVE-2023-27603fixed in 1.3.2 Critical 9.1Jul 6, 2023

Apache Linkis Authentication Bypass vulnerabilityCVE-2023-27987fixed in 1.3.2 High 8.8Jan 31, 2023

Apache Linkis contains Deserialization of Untrusted DataCVE-2022-44645fixed in 1.3.1 High 8.8Oct 26, 2022

Apache Linkis subject to Remote Code Execution via deserializationCVE-2022-39944fixed in 1.3.0