Sensitive Information Exposure in Apache Linkis: Password Leakage via Logging
Summary
GHSA-6vfr-p2hx-6v32: Apache Linkis: Password Exposure. Affects org.apache.linkis:linkis-metadata versions >= 1.0.0, < 1.8.0. Fixed in 1.8.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Linkis is a data integration and orchestration platform that facilitates the management of big data applications. It provides functionalities such as metadata management, job scheduling, and resource management. However, versions 1.0.0 to 1.7.0 of Linkis contain a vulnerability that can expose sensitive information, particularly passwords, through error logging when Base64 decoding fails.
Vulnerability Detail
The vulnerability arises from the method org.apache.linkis.metadata.util.HiveUtils.decode(), which logs the complete input parameter string when Base64 decoding fails. If the input contains sensitive information, such as Hive Metastore keys or plaintext passwords, these will be recorded in log files. This can lead to information leakage, especially if log files are accessible to unauthorized users. The risk is heightened when invalid Base64 strings are used as configuration values, and logs are exposed at the Error level.
How To Fix
Minimum fixed version
1.8.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that log files are only accessible to authorized personnel and consider implementing additional logging controls to filter out sensitive information.
Conclusion
The Apache Linkis vulnerability presents a risk of sensitive information exposure through error logging. Users are strongly advised to upgrade to version 1.8.0 or later to mitigate this risk. Implementing proper access controls on log files can also help reduce the likelihood of information leakage.
See every vulnerability recorded for org.apache.linkis:linkis-metadata →
FAQ
The CVSS score of this vulnerability is 6.5, indicating a moderate level of severity.
Versions 1.0.0 to 1.7.0 of Apache Linkis are affected by this vulnerability.
Sensitive information such as Hive Metastore keys and plaintext passwords can be exposed in the logs.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Vulert monitors and alerts in real-time for open-source vulnerabilities using just the pom.xml file. It helps developers stay informed about potential security issues.
