CVE-2024-39928: Apache Linkis Spark EngineConn: Commons Lang's RandomStringUtils Random string security vulnerability
Published Sep 24, 2024
·Updated
In Apache Linkis <= 1.5.0, a Random string security vulnerability in Spark EngineConn, random string generated by the Token when starting Py4j uses the Commons Lang's RandomStringUtils. Users are recommended to upgrade to version 1.6.0, which fixes this issue.
Affected Software
2 affected componentsFixes available
Apache linkis>=1.3.0<1.6.0
maven/org.apache.linkis:linkis-engineplugin-spark<1.6.0
1.6.0
Event History
Sep 24, 2024
CVE Published
via MITRE·07:27 AM
Data Sourced
via MITRE·07:27 AM
DescriptionWeakness
Sep 25, 2024
Advisory Published
via GitHub·03:30 AM
Data Sourced
via GitHub·03:30 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-39928?
CVE-2024-39928 has a medium severity rating due to its potential impact on security through a predictable random string.
2
How do I fix CVE-2024-39928?
To fix CVE-2024-39928, upgrade Apache Linkis to version 1.6.0 or later.
3
What software is affected by CVE-2024-39928?
CVE-2024-39928 affects Apache Linkis versions 1.5.0 and earlier.
4
What component of Apache Linkis does CVE-2024-39928 impact?
CVE-2024-39928 impacts the Spark EngineConn component due to a random string security vulnerability.
5
What specific vulnerability type is CVE-2024-39928?
CVE-2024-39928 is classified as a random string security vulnerability.