CVE-2022-44645: Deserialization of Untrusted Data

January 31, 2023 (updated November 9, 2023)

In Apache Linkis <=1.3.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attacker has write access to a database and configures new datasource with a MySQL data source and malicious parameters. Therefore, the parameters in the jdbc url should be block listed. Versions of Apache Linkis <= 1.3.0 will be affected. We recommend users to upgrade the version of Linkis to version 1.3.1.

References

github.com/advisories/GHSA-h6w8-52mq-4qxc
lists.apache.org/thread/zlcfmvt65blqc4n6fxypg6f0ns8fqfz4
nvd.nist.gov/vuln/detail/CVE-2022-44645

Detect and mitigate CVE-2022-44645 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →