Apache InLong vulnerable to JDBC Deserialization of Untrusted Data

CAO 8.8CVE-2023-27296 · GHSA-gpqq-59rp-3c3w · Công bố 27/03/2023 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2023-27296 là lỗ hổng mức CAO (CVSS 8.8) ảnh hưởng org.apache.inlong:inlong-manager, inlong (apache).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.5%, cao hơn 73.8% các lỗ hổng khác.
Cách xử lý: cập nhật lên 1.6.0 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
org.apache.inlong:inlong-manager Maven	`≥ 1.1.0, < 1.6.0`	`1.6.0`
inlong apache	`≥ 1.1.0, ≤ 1.5.0`	Chưa có bản vá

Mô tả

Apache InLong versions from 1.1.0 through 1.5.0 are vulnerable to Java Database Connectivity (JDBC) deserialization of untrusted data from the MySQL JDBC URL in MySQLDataNode. It could be triggered by authenticated users of InLong. This has been patched in version 1.6.0. Users are advised to upgrade to Apache InLong's latest version or cherry-pick the patch to solve it.

Mô tả của NVD

Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache InLong. It could be triggered by authenticated users of InLong, you could refer to [1] to know more about this vulnerability. This issue affects Apache InLong: from 1.1.0 through 1.5.0. Users are advised to upgrade to Apache InLong's latest version or cherry-pick [2] to solve it. [1] https://programmer.help/blogs/jdbc-deserialization-vulnerability-learning.html https://programmer.help/blogs/jdbc-deserialization-vulnerability-learning.html [2] https://github.com/apache/inlong/pull/7422 https://github.com/apache/inlong/pull/7422