Non notée
CVE-2022-43396 In the fix for CVE-2022-24697, a blacklist is used to filter user input commands
Description
In the fix for CVE-2022-24697, a blacklist is used to filter user input commands. But there is a risk of being bypassed. The user can control the command by controlling the kylin.engine.spark-cmd parameter of conf.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache Kylin 4.0 | premières → 4.0.2 | Pas de correctif indiqué |
Références
- lists.apache.org lists.apache.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Apache Kylin
Les 40 CVE de Apache Kylin →
CVE-2026-108837
Apache Kylin: Potential computed-column resource exhaustion
Non notée
CVE-2026-108833
Apache Kylin: default startup profile miss security settings
Non notée
CVE-2026-108823
Apache Kylin: Potential unauthenticated job metadata replacement
Non notée
CVE-2026-108780
Potential JDBC source configuration validation vulnerability in Apache Kylin
Non notée