CVE-2023-46302: Deserialization of Untrusted Data in apache-submarine
Summary
CVE-2023-46302: Deserialization of Untrusted Data in apache-submarine. Affects apache-submarine versions >= 0.7.0, < 0.8.0. Fixed in 0.8.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Submarine is an open-source project developed by the Apache Software Foundation. It is used for running machine learning and deep learning workflows on Kubernetes. The project utilizes JAXRS to define REST endpoints and includes a YamlEntityProvider entity provider to handle YAML requests. This vulnerability in Apache Submarine is caused by a bug in the snakeyaml library, which is used for serializing and deserializing YAML data.
Vulnerability Detail
The vulnerability arises when handling YAML requests in Apache Submarine. The YamlEntityProvider entity provider's readFrom method is responsible for unmarshaling the user-supplied data. Due to the bug in snakeyaml, untrusted data can be deserialized, leading to potential remote code execution or other security issues. This vulnerability affects Apache Submarine versions 0.7.0 to 0.8.0.
How To Fix
Minimum fixed version
0.8.0
This is the first release that contains the fix.
pip install --upgrade "apache-submarine==0.8.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to version 0.8.0 is not feasible, users can apply the following workaround:
- Clone the Apache Submarine repository:
git clone https://github.com/apache/submarine.git - Checkout the branch with the fix:
git checkout <branch_name> - Rebuild the submarine-server image:
docker build -t submarine-server . - Run the updated image in your environment.
Conclusion
The vulnerability in Apache Submarine allows for the deserialization of untrusted data, posing a risk of remote code execution or other security issues. Users are advised to upgrade to version 0.8.0 or apply the provided workaround. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache-submarine →
FAQ
Apache Submarine is an open-source project for running machine learning and deep learning workflows on Kubernetes.
This vulnerability allows for the deserialization of untrusted data, which can lead to potential remote code execution or other security issues.
Versions 0.7.0 to 0.8.0 of Apache Submarine are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade to Apache Submarine version 0.8.0 or apply the provided workaround.
Yes, users can apply the provided workaround by cherry-picking the relevant pull request and rebuilding the submarine-server image.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache-submarine.
