CVE-2023-29215: Apache Linkis JDBC EngineCon has a deserialization command execution
In Apache Linkis <=1.3.1, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in JDBC EengineConn Module will trigger a deserialization vulnerability and eventually lead to remote code execution. Therefore, the parameters in the Mysql JDBC URL should be blacklisted. Versions of Apache Linkis <= 1.3.0 will be affected. We recommend users upgrade the version of Linkis to version 1.3.2.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-29215?
CVE-2023-29215 is classified as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2023-29215?
To fix CVE-2023-29215, upgrade Apache Linkis to version 1.3.2 or later, which includes security patches.
What systems are affected by CVE-2023-29215?
CVE-2023-29215 affects Apache Linkis versions up to and including 1.3.1.
What type of vulnerability is CVE-2023-29215?
CVE-2023-29215 is a deserialization vulnerability that can lead to remote code execution when malicious MySQL JDBC parameters are used.
Who can exploit CVE-2023-29215?
Any attacker with access to configure JDBC parameters in the JDBC EengineConn Module can exploit CVE-2023-29215.