CVE-2023-24997: Apache InLong Deserialization of Untrusted Data Vulnerability
Summary
CVE-2023-24997: Apache InLong vulnerable to Deserialization of Untrusted Data vulnerability. Affects org.apache.inlong:inlong versions >= 1.1.0, <= 1.5.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache InLong is an open-source project developed by the Apache Software Foundation. It is a distributed processing platform designed for real-time big data streaming. Apache InLong allows users to collect, process, and analyze large volumes of data in real-time. It is commonly used in data-intensive applications and provides various features for data ingestion, transformation, and storage. However, Apache InLong versions 1.1.0 through 1.5.0 are vulnerable to a Deserialization of Untrusted Data vulnerability.
Vulnerability Detail
The Deserialization of Untrusted Data vulnerability in Apache InLong allows an attacker to exploit the deserialization process and execute arbitrary code on the target system. This vulnerability can be triggered when Apache InLong processes untrusted data without proper validation, allowing an attacker to inject malicious serialized objects. If successfully exploited, an attacker can gain unauthorized access, escalate privileges, or execute arbitrary commands on the affected system. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is recommended to follow the fix instructions provided in the 'how_to_fix' section.
Conclusion
Apache InLong versions 1.1.0 through 1.5.0 are vulnerable to a critical Deserialization of Untrusted Data vulnerability. To ensure the security of your Apache InLong installation, it is recommended to upgrade to the latest version or apply the provided fix. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.apache.inlong:inlong →
FAQ
Apache InLong is an open-source distributed processing platform designed for real-time big data streaming. It provides features for data ingestion, transformation, and storage.
The vulnerability allows an attacker to execute arbitrary code on the target system, potentially leading to unauthorized access, privilege escalation, or arbitrary command execution.
Versions 1.1.0 through 1.5.0 of Apache InLong are affected by this vulnerability.
You can fix the vulnerability by upgrading to the latest version of Apache InLong or applying the fix provided in the GitHub pull request.
The CVSS score of this vulnerability is 9.8, indicating its critical severity.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.inlong:inlong.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
