CVE-2025-59355: Apache Linkis: Password Exposure
A vulnerability.
When org.apache.linkis.metadata.util.HiveUtils.decode() fails to perform Base64 decoding, it records the complete input parameter string in the log via logger.error(str + "decode failed", e). If the input parameter contains sensitive information such as Hive Metastore keys, plaintext passwords will be left in the log files when decoding fails, resulting in information leakage.
Affected Scope Component: Sensitive fields in hive-site.xml (e.g., javax.jdo.option.ConnectionPassword) or other fields encoded in Base64. Version: Apache Linkis 1.0.0 – 1.7.0
Trigger Conditions The value of the configuration item is an invalid Base64 string. Log files are readable by users other than hive-site.xml administrators.
Severity: Low The probability of Base64 decoding failure is low. The leakage is only triggered when logs at the Error level are exposed.
Remediation Apache Linkis 1.8.0 and later versions have replaced the log with desensitized content. logger.error("URL decode failed: {}", e.getMessage()); // 不再输出 str
Users are recommended to upgrade to version 1.8.0, which fixes the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59355?
CVE-2025-59355 is considered a critical vulnerability due to the potential exposure of sensitive information in the logs.
How do I fix CVE-2025-59355?
To remediate CVE-2025-59355, upgrade your Apache Linkis installation to version 1.8.0 or later.
What types of sensitive information are at risk in CVE-2025-59355?
CVE-2025-59355 may expose sensitive data that is included in the input parameters logged after a Base64 decoding failure.
Which versions of Apache Linkis are affected by CVE-2025-59355?
CVE-2025-59355 affects Apache Linkis versions ranging from 1.0.0 to 1.7.0.
What component of Apache Linkis does CVE-2025-59355 impact?
CVE-2025-59355 impacts the logging functionality within the org.apache.linkis.metadata.util.HiveUtils component.