Description
In the fix for CVE-2022-24697, a blacklist is used to filter user input commands. But there is a risk of being bypassed. The user can control the command by controlling the kylin.engine.spark-cmd parameter of conf.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Kylin | Apache Kylin 4 – ≤ 4.0.2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.kylin:kylin | >= 2.0.0, < 4.0.3 | 4.0.3 | GHSA-f5q9-j9r2-34gq |
References
- https://lists.apache.org/thread/ob2ks04zl5ms0r44cd74y1xdl1rzfd1r vendor-advisory