Skip to content
OpenAdvisories
Critical · 9.8 CVE-2023-46226 EUVD-2024-0014GHSA-rxgg-273w-rfw7PYSEC-2024-11

Apache IoTDB: Remote Code Execution (RCE) risk via the UDF

Published Jan 15, 2024 · Updated Jun 20, 2025 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache IoTDB Package: apache-iotdb Package: org.apache.iotdb:iotdb-core Ecosystem: Maven Ecosystem: PyPI

Description

Remote Code Execution vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 1.0.0 through 1.2.2.

Users are recommended to upgrade to version 1.3.0, which fixes the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache IoTDB 1.0.0 – ≤ 1.2.2 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.iotdb:iotdb-core >= 1.0.0, < 1.3.0 1.3.0 GHSA-rxgg-273w-rfw7
PyPI apache-iotdb >= 1.0.0, < 1.3.0 1.3.0 PYSEC-2024-11

References