| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.flink:flink-cdc-pipeline-connectors | ≥ 3.0.0, < 3.5.0 | 3.5.0 |
| org.apache.flink:flink-connector-db2-cdc | ≥ 3.0.0, < 3.5.0 | 3.5.0 |
| org.apache.flink:flink-connector-mysql-cdc | ≥ 3.0.0, < 3.5.0 | 3.5.0 |
| org.apache.flink:flink-connector-oracle-cdc | ≥ 3.0.0, < 3.5.0 | 3.5.0 |
| org.apache.flink:flink-connector-sqlserver-cdc | ≥ 3.0.0, < 3.5.0 | 3.5.0 |
| flink cdc | = 3.4.0 |
Apache Flink CDC version 3.0.0 to before 3.5.0 are vulnerable to a SQL injection via maliciously crafted identifiers eg. crafted database name or crafted table name. Even through only the logged-in database user can trigger the attack, users are recommended to update Flink CDC version to 3.5.0 which address this issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free