Apache Linkis DataSource's JDBC Datasource Module with DB2 has JNDI Injection vulnerability

高 8.8CVE-2023-49566 · GHSA-7qpc-4xx9-x5qw · 15/07/2024 公開 · 17/06/2026 更新

要点

CVE-2023-49566 は org.apache.linkis:linkis-datasource, linkis (apache) に影響する深刻度「高」 (CVSS 8.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.84%（全脆弱性の 58.1% より高い）。
対処：1.6.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.apache.linkis:linkis-datasource Maven	`< 1.6.0`	`1.6.0`
linkis apache	`≥ 1.4.0, < 1.6.0`	`1.6.0`

概要

In Apache Linkis <=1.5.0, due to the lack of effective filteringof parameters, an attacker configuring malicious db2 parameters in the DataSource Manager Module will result in jndi injection. Therefore, the parameters in the DB2 URL should be blacklisted.

This attack requires the attacker to obtain an authorized account from Linkis before it can be carried out.

Versions of Apache Linkis <=1.5.0 will be affected. We recommend users upgrade the version of Linkis to version 1.6.0.

NVD の説明

In Apache Linkis <=1.5.0, due to the lack of effective filtering of parameters, an attacker configuring malicious db2 parameters in the DataSource Manager Module will result in jndi injection. Therefore, the parameters in the DB2 URL should be blacklisted. This attack requires the attacker to obtain an authorized account from Linkis before it can be carried out. Versions of Apache Linkis <=1.5.0 will be affected. We recommend users upgrade the version of Linkis to version 1.6.0.