Non notée
CVE-2021-26919 Apache Druid allows users to read data from other database systems using JDBC
Description
Apache Druid allows users to read data from other database systems using JDBC. This functionality is to allow trusted users with the proper permissions to set up lookups or submit ingestion tasks. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker to execute arbitrary code from a hacker-controlled malicious MySQL server within Druid server processes. This issue was addressed in Apache Druid 0.20.2
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache Druid 0.20 | premières → 0.20.1 | Pas de correctif indiqué |
Références
- lists.apache.org lists.apache.org
- [druid-dev] 20210331 Regarding the 0.21.0 release lists.apache.org
- [druid-dev] 20210401 Re: Subject: [CVE-2021-26919] Authenticated users can execute arbitrary code from malicious MySQL database systems lists.apache.org
- [druid-commits] 20210401 [GitHub] [druid] jihoonson merged pull request #11047: Allow list for JDBC connection properties to address CVE-2021-26919 lists.apache.org
- [druid-dev] 20210405 Regarding the CVSS score for CVE-2021-26919 lists.apache.org
- [druid-dev] 20210405 Re: Regarding the CVSS score for CVE-2021-26919 lists.apache.org
- [druid-commits] 20210412 [GitHub] [druid] jihoonson opened a new pull request #11100: [Backport] Allow list for JDBC connection properties to address CVE-2021-26919 lists.apache.org
- [druid-commits] 20210412 [GitHub] [druid] jihoonson merged pull request #11100: [Backport] Allow list for JDBC connection properties to address CVE-2021-26919 lists.apache.org
- [druid-dev] 20210414 Re: Regarding the CVSS score for CVE-2021-26919 lists.apache.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Apache Druid
Les 11 CVE de Apache Druid →
CVE-2026-23906
Affected Products and Versions * Apache Druid * Affected Versions: 0.17.0 through 35.x (all versions prior to…
Non notée
CVE-2025-59390
Apache Druid’s Kerberos authenticator uses a weak fallback secret when the…
Non notée
CVE-2025-27888
Severity: medium (5.8) / important Server-Side Request Forgery (SSRF), Improper Neutralization of Input During Web…
5.8
Moyenne
CVE-2024-45537
Apache Druid allows users with certain permissions to read data from other database systems using JDBC
Non notée