| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.drill.exec:drill-java-exec | ≥ 1.19.0, < 1.21.2 | 1.21.2 |
| drill | ≥ 1.9.0, < 1.21.2 | 1.21.2 |
XXE in the XML Format Plugin in Apache Drill version 1.19.0 and greater allows a user to read any file on a remote file system or execute commands via a malicious XML file. Users are recommended to upgrade to version 1.21.2, which fixes this issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free