CVE-2023-27296: Apache InLong: JDBC Deserialization Vulnerability in InLong
Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache InLong.
It could be triggered by authenticated users of InLong, you could refer to [1] to know more about this vulnerability.
This issue affects Apache InLong: from 1.1.0 through 1.5.0. Users are advised to upgrade to Apache InLong's latest version or cherry-pick [2] to solve it.
[1] https://programmer.help/blogs/jdbc-deserialization-vulnerability-learning.html
https://programmer.help/blogs/jdbc-deserialization-vulnerability-learning.html
[2] https://github.com/apache/inlong/pull/7422 https://github.com/apache/inlong/pull/7422
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2023-27296.
What is the title of this vulnerability?
The title of this vulnerability is 'Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache InLong.'
Who can trigger this vulnerability?
This vulnerability can be triggered by authenticated users of InLong.
Which version of Apache InLong is affected by this vulnerability?
This vulnerability affects Apache InLong versions 1.1.0 through 1.5.0.
What is the severity level of this vulnerability?
The severity level of this vulnerability is high (8.8).
How can users fix this vulnerability?
Users are advised to upgrade their Apache InLong installation to a version higher than 1.5.0.
What is the Common Weakness Enumeration (CWE) ID associated with this vulnerability?
The Common Weakness Enumeration (CWE) ID associated with this vulnerability is 502.