CVE-2023-34434

Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0. The attacker could bypass the current logic and achieve arbitrary file reading. To solve it, users are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick https://github.com/apache/inlong/pull/8130 .

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
http://seclists.org/fulldisclosure/2023/Jul/43	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/07/25/3	Mailing List Third Party Advisory
https://lists.apache.org/thread/7f1o71w5r732cspltmtdydn01gllf4jo	Vendor Advisory
http://seclists.org/fulldisclosure/2023/Jul/43	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/07/25/3	Mailing List Third Party Advisory
https://lists.apache.org/thread/7f1o71w5r732cspltmtdydn01gllf4jo	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:inlong:*:*:*:*:*:*:*:*

History

21 Nov 2024, 08:07

Type	Values Removed	Values Added
References	~~() http://seclists.org/fulldisclosure/2023/Jul/43 - Mailing List, Third Party Advisory~~	() http://seclists.org/fulldisclosure/2023/Jul/43 - Mailing List, Third Party Advisory
References	~~() http://www.openwall.com/lists/oss-security/2023/07/25/3 - Mailing List, Third Party Advisory~~	() http://www.openwall.com/lists/oss-security/2023/07/25/3 - Mailing List, Third Party Advisory
References	~~() https://lists.apache.org/thread/7f1o71w5r732cspltmtdydn01gllf4jo - Vendor Advisory~~	() https://lists.apache.org/thread/7f1o71w5r732cspltmtdydn01gllf4jo - Vendor Advisory

02 Aug 2023, 03:53

Type	Values Removed	Values Added
First Time		Apache inlong Apache
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5
CPE		cpe:2.3:a:apache:inlong::::::::
References	~~(MISC) https://lists.apache.org/thread/7f1o71w5r732cspltmtdydn01gllf4jo -~~	(MISC) https://lists.apache.org/thread/7f1o71w5r732cspltmtdydn01gllf4jo - Vendor Advisory
References	~~(MISC) http://seclists.org/fulldisclosure/2023/Jul/43 -~~	(MISC) http://seclists.org/fulldisclosure/2023/Jul/43 - Mailing List, Third Party Advisory
References	~~(MISC) http://www.openwall.com/lists/oss-security/2023/07/25/3 -~~	(MISC) http://www.openwall.com/lists/oss-security/2023/07/25/3 - Mailing List, Third Party Advisory

26 Jul 2023, 07:15

Type	Values Removed	Values Added
References		(MISC) http://seclists.org/fulldisclosure/2023/Jul/43 -

25 Jul 2023, 13:00

Type	Values Removed	Values Added
References		(MISC) http://www.openwall.com/lists/oss-security/2023/07/25/3 -

25 Jul 2023, 08:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-07-25 08:15

Updated : 2024-11-21 08:07

NVD link : CVE-2023-34434

Mitre link : CVE-2023-34434

CVE.ORG link : CVE-2023-34434

JSON object : View

Products Affected

apache

inlong

CWE

CWE-502

Deserialization of Untrusted Data

7.5 /10