Description

Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Attackers would bypass the 'autoDeserialize' option filtering by adding blanks. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick  https://github.com/apache/inlong/pull/7674 https://github.com/apache/inlong/pull/7674 to solve it.

Remediation

References

https://lists.apache.org/thread/bkcgbn9l61croxfyspf7xd42qb189s3z

Related Vulnerabilities

CVE-2016-3726 Vulnerability in maven package org.jenkins-ci.main:jenkins-core

CVE-2023-37960 Vulnerability in maven package io.jenkins.plugins:mathworks-polyspace

CVE-2018-1000186 Vulnerability in maven package org.jenkins-ci.plugins:ghprb

CVE-2020-2125 Vulnerability in maven package ru.yandex.jenkins.plugins.debuilder:debian-package-builder

CVE-2014-2062 Vulnerability in maven package org.jenkins-ci.main:jenkins-core

Severity

High

Classification

CWE-502 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Tags

Vendor Advisory