Skip to content
Sign in
Not rated

CVE-2023-49566 In Apache…

Description

In Apache Linkis <=1.5.0, due to the lack of effective filtering of parameters, an attacker configuring malicious db2 parameters in the DataSource Manager Module will result in jndi injection. Therefore, the parameters in the DB2 URL should be blacklisted.  This attack requires the attacker to obtain an authorized account from Linkis before it can be carried out. Versions of Apache Linkis <=1.5.0 will be affected. We recommend users upgrade the version of Linkis to version 1.6.0.

Affected products and versions

Product Affected versions Fixed in
Apache Linkis DataSource 1.6 earliest → < 1.6.0 1.6.0

Other CVEs of Apache Linkis DataSource

The 4 CVEs of Apache Linkis DataSource →
CVE-2023-46801 In Apache… Not rated CVE-2023-41916 In Apache Linkis =1.4.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql… Not rated CVE-2023-50740 In Apache… Not rated
Track this CVE