Description

Apache Kylin allows users to read data from other database systems using JDBC. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker to execute arbitrary code from a hacker-controlled malicious MySQL server within Kylin server processes. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions.

Remediation

References

https://lists.apache.org/thread/lchpcvoolc6w8zc6vo1wstk8zbfqv2ow

http://www.openwall.com/lists/oss-security/2022/01/06/5

Related Vulnerabilities

CVE-2019-0222 Vulnerability in maven package org.fusesource.mqtt-client:mqtt-client

CVE-2019-10345 Vulnerability in maven package io.jenkins:configuration-as-code

CVE-2023-35157 Vulnerability in maven package org.xwiki.platform:xwiki-platform-oldcore

CVE-2022-22969 Vulnerability in maven package org.springframework.security.oauth:spring-security-oauth

CVE-2023-37582 Vulnerability in maven package org.apache.rocketmq:rocketmq-namesrv

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Mailing List Vendor Advisory Third Party Advisory NVD-CWE-noinfo