Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWh4NWctOGhxMi04eDR3
SQL Injection in Kylin
Kylin concatenates and executes a Hive SQL in Hive CLI or beeline when building a new segment; some part of the HQL is from system configurations, while the configuration can be overwritten by certain rest api, which makes SQL injection attack is possible. Users of all previous versions after 2.0 should upgrade to 3.1.0.
Permalink: https://github.com/advisories/GHSA-hx5g-8hq2-8x4wJSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWh4NWctOGhxMi04eDR3
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: almost 4 years ago
Updated: over 1 year ago
CVSS Score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Identifiers: GHSA-hx5g-8hq2-8x4w, CVE-2020-13926
References:
- https://nvd.nist.gov/vuln/detail/CVE-2020-13926
- https://lists.apache.org/thread.html/r021baf9d8d4ae41e8c8332c167c4fa96c91b5086563d9be55d2d7acf@%3Ccommits.kylin.apache.org%3E
- https://lists.apache.org/thread.html/r63d5663169e866d44ff9250796193337cff7d9cf61cc3839e86163fd%40%3Cuser.kylin.apache.org%3E
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEKYLIN-584374
- https://github.com/advisories/GHSA-hx5g-8hq2-8x4w
Affected Packages
maven:org.apache.kylin:kylin-server-base
Dependent packages: 7Dependent repositories: 52
Downloads:
Affected Version Ranges: < 3.1.0
Fixed in: 3.1.0
All affected versions: 1.5.3, 1.5.4, 1.6.0, 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0, 3.0.1, 3.0.2
All unaffected versions: 3.1.0, 3.1.1, 3.1.2, 3.1.3, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4