CVE-2023-29216

CRITICAL

Apache Linkis <=1.3.1 - Deserialization

Title source: llm

Description

In Apache Linkis <=1.3.1, because the parameters are not effectively filtered, the attacker uses the MySQL data source and malicious parameters to configure a new data source to trigger a deserialization vulnerability, eventually leading to remote code execution. Versions of Apache Linkis <= 1.3.0 will be affected. We recommend users upgrade the version of Linkis to version 1.3.2.

References (2)

[Mailing List, Third Party Advisory] http://www.openwall.com/lists/oss-security/2023/04/10/5

[Mailing List, Vendor Advisory] https://lists.apache.org/thread/18vv0m32oy51nzk8tbz13qdl5569y55l

Scores

CVSS v3 9.8

EPSS 0.0481

EPSS Percentile 89.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-502

Status published

Affected Products (2)

apache/linkis < 1.3.1

org.apache.linkis/linkis-datasource < 1.3.2Maven

Timeline

Published Apr 10, 2023

Tracked Since Feb 18, 2026