CVE-2023-31058

Опубликовано: 22 мая 2023

Источник: nvd

CVSS3: 7.5

EPSS Низкий

Описание

Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Attackers would bypass the 'autoDeserialize' option filtering by adding blanks. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick

https://github.com/apache/inlong/pull/7674 https://github.com/apache/inlong/pull/7674 to solve it.

Ссылки

https://lists.apache.org/thread/bkcgbn9l61croxfyspf7xd42qb189s3z
Vendor Advisory
https://lists.apache.org/thread/bkcgbn9l61croxfyspf7xd42qb189s3z
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:apache:inlong:*:*:*:*:*:*:*:*

Версия от 1.4.0 (включая) до 1.6.0 (включая)

EPSS

Процентиль: 36%

0.00155

Низкий

7.5 High

CVSS3

Дефекты

CWE-502

Связанные уязвимости

GHSA-c3rh-f2w5-fghm

CVSS3: 7.5

github

больше 2 лет назад

Apache InLong Deserialization of Untrusted Data Vulnerability

BDU:2024-01759

CVSS3: 9.8

fstec