CVE-2023-29216: Apache Linkis DatasourceManager module has a deserialization command execution
In Apache Linkis <=1.3.1, because the parameters are not effectively filtered, the attacker uses the MySQL data source and malicious parameters to configure a new data source to trigger a deserialization vulnerability, eventually leading to remote code execution. Versions of Apache Linkis <= 1.3.0 will be affected. We recommend users upgrade the version of Linkis to version 1.3.2.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-29216?
CVE-2023-29216 is a vulnerability in Apache Linkis <=1.3.1 that allows an attacker to trigger a deserialization vulnerability and achieve remote code execution.
What is the severity of CVE-2023-29216?
The severity of CVE-2023-29216 is critical with a severity value of 9.8 out of 10.
How does CVE-2023-29216 work?
CVE-2023-29216 works by allowing an attacker to use the MySQL data source and malicious parameters to configure a new data source, triggering a deserialization vulnerability and leading to remote code execution.
Which versions of Apache Linkis are affected by CVE-2023-29216?
Versions of Apache Linkis up to and including 1.3.1 are affected by CVE-2023-29216.
How can CVE-2023-29216 be fixed?
To fix CVE-2023-29216, it is recommended to update Apache Linkis to a version higher than 1.3.1.