Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1qajMyLTNwZjUtNW12Nc4AA2jn

Apache InLong Deserialization of Untrusted Data Vulnerability

Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.

This issue affects Apache InLong: from 1.4.0 through 1.8.0, the attacker can use \t to bypass. Users are advised to upgrade to Apache InLong's 1.9.0 or cherry-pick [1] to solve it.

[1] https://github.com/apache/inlong/pull/8814

Permalink: https://github.com/advisories/GHSA-jj32-3pf5-5mv5
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qajMyLTNwZjUtNW12Nc4AA2jn
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 1 year ago
Updated: about 1 year ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS Percentage: 0.00166
EPSS Percentile: 0.53689

Identifiers: GHSA-jj32-3pf5-5mv5, CVE-2023-46227
References:

• https://nvd.nist.gov/vuln/detail/CVE-2023-46227
• https://lists.apache.org/thread/m8txor4f76tmrxksrmc87tw42g57nz33
• https://github.com/apache/inlong/pull/8814
• https://github.com/advisories/GHSA-jj32-3pf5-5mv5

Repository: https://github.com/apache/inlong
Blast Radius: 11.6

Affected Packages