CVE-2020-1956: Apache Kylin OS Command Injection Vulnerability
Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.
Other sources
Apache Kylin contains an OS command injection vulnerability which could permit an attacker to perform remote code execution.
— CISA
Kylin has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.kylin:kylin-core-commonto a version that resolves this vulnerability.Fixed in 3.0.2 - Upgrade
Upgrade
maven/org.apache.kylin:kylin-core-commonto a version that resolves this vulnerability.Fixed in 2.6.6
Event History
Frequently Asked Questions
What is CVE-2020-1956?
CVE-2020-1956 is an OS Command Injection Vulnerability in Apache Kylin.
How does Apache Kylin OS Command Injection Vulnerability work?
Apache Kylin 2.3.0 and releases up to 2.6.5 and 3.0.1 has restful APIs that allow concatenation of OS commands with user input, enabling execution of arbitrary OS commands without protection or validation.
What is the severity of CVE-2020-1956?
CVE-2020-1956 has a severity level of 8.8 (Critical).
Which versions of Apache Kylin are affected by CVE-2020-1956?
Apache Kylin versions 2.3.0 to 2.6.5 and 3.0.1 are affected by CVE-2020-1956.
How can I fix Apache Kylin OS Command Injection Vulnerability?
Upgrade your Apache Kylin installation to a version beyond 2.6.5 or 3.0.1 that includes the necessary security patches.