Skip to content
OpenAdvisories
High · 7.5 CVE-2023-46227 EUVD-2023-2762GHSA-jj32-3pf5-5mv5

Apache inlong has an Arbitrary File Read Vulnerability

Published Oct 19, 2023 · Updated Sep 12, 2024 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache InLong Package: org.apache.inlong:manager-common Package: org.apache.inlong:manager-pojo Ecosystem: Maven

Description

Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.

This issue affects Apache InLong: from 1.4.0 through 1.8.0, the attacker can use \t to bypass. Users are advised to upgrade to Apache InLong's 1.9.0 or cherry-pick [1] to solve it.

[1] https://github.com/apache/inlong/pull/8814

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache InLong 1.4.0 – ≤ 1.8.0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.inlong:manager-common >= 1.4.0, < 1.9.0 1.9.0 GHSA-jj32-3pf5-5mv5
Maven org.apache.inlong:manager-pojo >= 1.4.0, < 1.9.0 1.9.0 GHSA-jj32-3pf5-5mv5

References