CVE-2023-27296: Apache InLong: JDBC Deserialization Vulnerability in InLong
First published: Mon Mar 27 2023(Updated: )
Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache InLong. It could be triggered by authenticated users of InLong, you could refer to [1] to know more about this vulnerability. This issue affects Apache InLong: from 1.1.0 through 1.5.0. Users are advised to upgrade to Apache InLong's latest version or cherry-pick [2] to solve it. [1] https://programmer.help/blogs/jdbc-deserialization-vulnerability-learning.html https://programmer.help/blogs/jdbc-deserialization-vulnerability-learning.html [2] https://github.com/apache/inlong/pull/7422 https://github.com/apache/inlong/pull/7422
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache InLong | >=1.1.0<=1.5.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2023-27296.
What is the title of this vulnerability?
The title of this vulnerability is 'Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache InLong.'
Who can trigger this vulnerability?
This vulnerability can be triggered by authenticated users of InLong.
Which version of Apache InLong is affected by this vulnerability?
This vulnerability affects Apache InLong versions 1.1.0 through 1.5.0.
What is the severity level of this vulnerability?
The severity level of this vulnerability is high (8.8).
How can users fix this vulnerability?
Users are advised to upgrade their Apache InLong installation to a version higher than 1.5.0.
What is the Common Weakness Enumeration (CWE) ID associated with this vulnerability?
The Common Weakness Enumeration (CWE) ID associated with this vulnerability is 502.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/author
- agent/references
- agent/title
- agent/remedy
- agent/severity
- agent/weakness
- agent/description
- agent/event
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- vendor/apache
- canonical/apache inlong
- version/apache inlong/1.1.0
- version/apache inlong/1.5.0