CVE-2023-37924: SQL injection in Apache Submarine
Summary
CVE-2023-37924: SQL injection in Apache Submarine. Affects apache-submarine versions >= 0.7.0, < 0.8.0. Fixed in 0.8.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Submarine is an open-source project developed by the Apache Software Foundation. It provides a distributed machine learning platform for running TensorFlow jobs on Kubernetes. The project allows users to train and deploy machine learning models at scale. However, versions of Apache Submarine prior to 0.8.0 are vulnerable to an SQL injection attack when a user logs in. This vulnerability can lead to unauthorized access to the system.
Vulnerability Detail
The SQL injection vulnerability in Apache Submarine allows an attacker to manipulate the SQL queries used for user authentication during the login process. By injecting malicious SQL code, an attacker can bypass authentication and gain unauthorized access to the system. This can result in the compromise of sensitive data, unauthorized execution of commands, or further exploitation of the system. The vulnerability affects Apache Submarine versions 0.7.0 to 0.8.0.
How To Fix
Minimum fixed version
0.8.0
This is the first release that contains the fix.
pip install --upgrade "apache-submarine==0.8.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to upgrade to Apache Submarine 0.8.0 or apply the manual fixes, there is no specific workaround available. It is highly recommended to prioritize upgrading to the fixed version or applying the provided fixes to mitigate the vulnerability.
Conclusion
The SQL injection vulnerability in Apache Submarine can lead to unauthorized access and compromise of sensitive data. It is crucial to upgrade to Apache Submarine 0.8.0 or apply the provided fixes to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for apache-submarine →
FAQ
Apache Submarine is an open-source distributed machine learning platform for running TensorFlow jobs on Kubernetes. It provides a scalable and efficient solution for training and deploying machine learning models.
SQL injection is a type of security vulnerability where an attacker can manipulate SQL queries to execute unauthorized commands or access sensitive data. In the case of Apache Submarine, the SQL injection vulnerability allows an attacker to bypass authentication and gain unauthorized access to the system.
You can use Vulert's playground at Vulert Scanner to check if your Apache Submarine installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability in Apache Submarine. However, it is important to promptly apply the recommended fixes to mitigate the risk of exploitation.
You can find more information about Apache Submarine on the official Apache Submarine website at https://submarine.apache.org.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache-submarine.
