CVE-2023-27296 — Apache InLong: JDBC Deserialization Vulnerability in InLong

Description (CNA)

Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache InLong. It could be triggered by authenticated users of InLong, you could refer to [1] to know more about this vulnerability. This issue affects Apache InLong: from 1.1.0 through 1.5.0. Users are advised to upgrade to Apache InLong's latest version or cherry-pick [2] to solve it. [1] https://programmer.help/blogs/jdbc-deserialization-vulnerability-learning.html https://programmer.help/blogs/jdbc-deserialization-vulnerability-learning.html [2] https://github.com/apache/inlong/pull/7422 https://github.com/apache/inlong/pull/7422

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache InLong	affected 1.1.0 through 1.5.0

CWE

CWE-502

References

https://lists.apache.org/thread/xbvtjw9bwzgbo9fp1by8o3p49nf59xzt

ADP enrichment

CVE

No English description supplied.

https://lists.apache.org/thread/xbvtjw9bwzgbo9fp1by8o3p49nf59xzt

CISA-ADP

No English description supplied.

No references supplied.