CVE-2021-36774: Mysql JDBC Connector Deserialize RCE
Apache Kylin allows users to read data from other database systems using JDBC. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker to execute arbitrary code from a hacker-controlled malicious MySQL server within Kylin server processes. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-36774?
CVE-2021-36774 is a vulnerability in Apache Kylin that allows users to read data from other database systems using JDBC, potentially enabling an attacker to execute arbitrary code from a malicious MySQL server within Kylin server processes.
What is the severity of CVE-2021-36774?
The severity of CVE-2021-36774 is medium with a severity score of 6.5.
Which software versions are affected by CVE-2021-36774?
The affected software versions are Apache Kylin versions 2.0.0 to 2.6.6 and Apache Kylin versions 3.0.0 to 3.1.2.
How can I mitigate CVE-2021-36774?
To mitigate CVE-2021-36774, it is recommended to update Apache Kylin to version 3.1.3 which includes the necessary fix.
Where can I find more information about CVE-2021-36774?
You can find more information about CVE-2021-36774 on the NIST National Vulnerability Database (NVD) at https://nvd.nist.gov/vuln/detail/CVE-2021-36774 and on the Apache mailing list at https://lists.apache.org/thread/lchpcvoolc6w8zc6vo1wstk8zbfqv2ow.