CVE-2023-50740: Apache Linkis DataSource: DataSource module Oracle SQL Database Password Logged
Published Mar 6, 2024
·Updated
In Apache Linkis <=1.4.0, The password is printed to the log when using the Oracle data source of the Linkis data source module. We recommend users upgrade the version of Linkis to version 1.5.0
Affected Software
2 affected componentsFixes available
maven/org.apache.linkis:linkis<1.5.0
1.5.0
Apache linkis<1.5.0
Event History
Mar 6, 2024
CVE Published
via MITRE·01:44 PM
Data Sourced
via MITRE·01:44 PM
DescriptionWeakness
Data Sourced
via NVD·02:15 PM
DescriptionSeverityWeakness
Advisory Published
via GitHub·03:31 PM
Frequently Asked Questions
1
What is the severity of CVE-2023-50740?
CVE-2023-50740 is categorized as a medium severity vulnerability due to the exposure of sensitive information in logs.
2
How do I fix CVE-2023-50740?
To fix CVE-2023-50740, upgrade Apache Linkis to version 1.5.0 or later.
3
What is the impact of CVE-2023-50740?
The impact of CVE-2023-50740 is that sensitive passwords may be exposed in logs, posing a security risk.
4
Is CVE-2023-50740 present in versions of Apache Linkis after 1.4.0?
CVE-2023-50740 is only present in Apache Linkis versions 1.4.0 and earlier.
5
What should users do if they cannot upgrade from the affected version regarding CVE-2023-50740?
If users cannot upgrade from the affected version for CVE-2023-50740, they should implement logging controls to prevent exposure of sensitive information.