Security
Headlines
HeadlinesLatestCVEs

Headline

GHSA-3f3w-gmqf-4hj3: Apache Linkis subject to Remote Code Execution via deserialization

In Apache Linkis <=1.2.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attacker has write access to a database and configures a JDBC EC with a MySQL data source and malicious parameters. Therefore, the parameters in the jdbc url should be blacklisted. This issue is patched in version 1.3.0, and users are recommended to upgrade.

ghsa
#sql#vulnerability#apache#git#rce

Apache Linkis subject to Remote Code Execution via deserialization

Moderate severity GitHub Reviewed Published Oct 26, 2022 • Updated Oct 27, 2022

ghsa: Latest News

GHSA-5jfw-gq64-q45f: HTML Cleaner allows crafted scripts in special contexts like svg or math to pass through