Remote Code Execution vulnerability in Apache IoTDB via UDF

CRITICAL 9.8CVE-2023-46226 · GHSA-rxgg-273w-rfw7 · PYSEC-2024-11 · Published 15/01/2024 · updated 17/06/2026

Package	Affected versions	Patched versions
org.apache.iotdb:iotdb-core Maven	`≥ 1.0.0, < 1.3.0`	`1.3.0`
apache-iotdb PyPI	`≥ 1.0.0, < 1.3.0`	`1.3.0`
iotdb apache	`≥ 1.0.0, < 1.3.0`	`1.3.0`

Description

Remote Code Execution vulnerability in Apache IoTDB. This issue affects Apache IoTDB from 1.0.0 through 1.2.2.

Users are recommended to upgrade to version 1.3.0, which fixes the issue.

NVD description

Remote Code Execution vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 1.0.0 through 1.2.2. Users are recommended to upgrade to version 1.3.0, which fixes the issue.

References

nvd.nist.gov/vuln/detail/CVE-2023-46226 · ADVISORY
apache/iotdb · PACKAGE
pypa/advisory-database · WEB
lists.apache.org/thread/293b4ob65ftnfwyf62fb9zh8gwdy38hg · WEB
openwall.com/lists/oss-security/2024/01/15/1 · WEB
GitHub Advisory GHSA-rxgg-273w-rfw7 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free