Apache Linkis JDBC EngineCon has a deserialization command execution

CVE-2023-29215

Summary

In Apache Linkis versions up to and including 1.3.1, a security flaw exists that stems from insufficient filtering of parameters. This vulnerability allows an attacker to inject malicious MySQL JDBC parameters into the JDBC EengineConn Module. As a result, this can trigger a deserialization attack that may lead to remote code execution on affected systems. To mitigate this risk, it is essential to blacklist the parameters within the MySQL JDBC URL. Users are strongly advised to upgrade to Apache Linkis version 1.3.2 or later to ensure their systems are secure.

References