CVE-2020-1956: Apache Kylin OS Command Injection Vulnerability
First published: Fri May 22 2020(Updated: )
Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Kylin | >=2.3.0<=2.3.2 | |
| Apache Kylin | >=2.4.0<=2.4.1 | |
| Apache Kylin | >=2.5.0<=2.5.2 | |
| Apache Kylin | >=2.6.0<=2.6.5 | |
| Apache Kylin | =3.0.0 | |
| Apache Kylin | =3.0.0-alpha | |
| Apache Kylin | =3.0.0-alpha2 | |
| Apache Kylin | =3.0.0-beta | |
| Apache Kylin | =3.0.1 | |
| Apache Kylin | =2.4.0 | |
| Apache Kylin | =2.4.1 | |
| maven/org.apache.kylin:kylin-core-common | >=3.0.0<3.0.2 | 3.0.2 |
| maven/org.apache.kylin:kylin-core-common | <2.6.6 | 2.6.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2020/07/14/1
- https://community.sonarsource.com/t/apache-kylin-3-0-1-command-injection-vulnerability/25706
- https://lists.apache.org/thread.html/r021baf9d8d4ae41e8c8332c167c4fa96c91b5086563d9be55d2d7acf@%3Ccommits.kylin.apache.org%3E
- https://lists.apache.org/thread.html/r1332ef34cf8e2c0589cf44ad269fb1fb4c06addec6297f0320f5111d%40%3Cuser.kylin.apache.org%3E
- https://lists.apache.org/thread.html/r250a867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3eb@%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/r250a867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3eb@%3Cdev.kylin.apache.org%3E
- https://lists.apache.org/thread.html/r250a867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3eb@%3Cuser.kylin.apache.org%3E
- https://lists.apache.org/thread.html/r61666760d8a4e8764b2d5fe158d8a48b569414480fbfadede574cdc0@%3Ccommits.kylin.apache.org%3E
- https://lists.apache.org/thread.html/r021baf9d8d4ae41e8c8332c167c4fa96c91b5086563d9be55d2d7acf%40%3Ccommits.kylin.apache.org%3E
- https://lists.apache.org/thread.html/r250a867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3eb%40%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/r250a867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3eb%40%3Cdev.kylin.apache.org%3E
- https://lists.apache.org/thread.html/r250a867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3eb%40%3Cuser.kylin.apache.org%3E
- https://lists.apache.org/thread.html/r61666760d8a4e8764b2d5fe158d8a48b569414480fbfadede574cdc0%40%3Ccommits.kylin.apache.org%3E
- https://nvd.nist.gov/vuln/detail/CVE-2020-1956
- https://github.com/apache/kylin/commit/58fad56ac6aaa43c6bd8f962d7f2d84438664092
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEKYLIN-570207
- https://github.com/advisories/GHSA-gprm-xqrc-c2j3 (Advisory)
Frequently Asked Questions
What is CVE-2020-1956?
CVE-2020-1956 is an OS Command Injection Vulnerability in Apache Kylin.
How does Apache Kylin OS Command Injection Vulnerability work?
Apache Kylin 2.3.0 and releases up to 2.6.5 and 3.0.1 has restful APIs that allow concatenation of OS commands with user input, enabling execution of arbitrary OS commands without protection or validation.
What is the severity of CVE-2020-1956?
CVE-2020-1956 has a severity level of 8.8 (Critical).
Which versions of Apache Kylin are affected by CVE-2020-1956?
Apache Kylin versions 2.3.0 to 2.6.5 and 3.0.1 are affected by CVE-2020-1956.
How can I fix Apache Kylin OS Command Injection Vulnerability?
Upgrade your Apache Kylin installation to a version beyond 2.6.5 or 3.0.1 that includes the necessary security patches.
- collector/nvd-index
- agent/type
- agent/title
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/weakness
- agent/remedy
- agent/author
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-gprm-xqrc-c2j3
- alias/CVE-2020-1956
- agent/references
- agent/severity
- agent/description
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/first-publish-date
- agent/tags
- exploited/true
- collector/cisa-known-exploited
- source/CISA
- agent/softwarecombine
- agent/event
- collector/nvd-cve
- agent/last-modified-date
- agent/trending
- vendor/apache
- canonical/apache kylin
- version/apache kylin/2.3.0
- version/apache kylin/2.3.2
- version/apache kylin/2.4.0
- version/apache kylin/2.4.1
- version/apache kylin/2.5.0
- version/apache kylin/2.5.2
- version/apache kylin/2.6.0
- version/apache kylin/2.6.5
- version/apache kylin/3.0.0
- version/apache kylin/3.0.0-alpha
- version/apache kylin/3.0.0-alpha2
- version/apache kylin/3.0.0-beta
- version/apache kylin/3.0.1
- package-manager/maven