CVE-2023-29215: Apache Linkis JDBC EngineCon has a deserialization command execution
In Apache Linkis <=1.3.1, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in JDBC EengineConn Module will trigger a deserialization vulnerability and eventually lead to remote code execution. Therefore, the parameters in the Mysql JDBC URL should be blacklisted. Versions of Apache Linkis <= 1.3.0 will be affected. We recommend users upgrade the version of Linkis to version 1.3.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Linkisto a version that resolves this vulnerability.Fixed in 1.3.2 - Configuration
Blacklist parameters in the Mysql JDBC URL to prevent malicious JDBC parameters from triggering deserialization command execution.
Apache Linkis JDBC EngineConn Module Mysql JDBC URL parameters = blacklist
Event History
Frequently Asked Questions
What is the severity of CVE-2023-29215?
CVE-2023-29215 is classified as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2023-29215?
To fix CVE-2023-29215, upgrade Apache Linkis to version 1.3.2 or later, which includes security patches.
What systems are affected by CVE-2023-29215?
CVE-2023-29215 affects Apache Linkis versions up to and including 1.3.1.
What type of vulnerability is CVE-2023-29215?
CVE-2023-29215 is a deserialization vulnerability that can lead to remote code execution when malicious MySQL JDBC parameters are used.
Who can exploit CVE-2023-29215?
Any attacker with access to configure JDBC parameters in the JDBC EengineConn Module can exploit CVE-2023-29215.