CVE-2022-39944 The Apache Linkis JDBC EngineConn module has a RCE Vulnerability

What is CVE-2022-39944?

CVE-2022-39944 is a high-severity vulnerability in Apache Linkis, published on 26 Oct 2022.

Official description

In Apache Linkis <=1.2.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attacker has write access to a database and configures a JDBC EC with a MySQL data source and malicious parameters. Therefore, the parameters in the jdbc url should be blacklisted. Versions of Apache Linkis <= 1.2.0 will be affected, We recommend users to update to 1.3.0.

Weakness: CWE-502

Which versions are affected by CVE-2022-39944?

2 open source packages ship an affected version, including org.apache.linkis:linkis. It affects 1 product.

Products include Apache Linkis.

How do I fix CVE-2022-39944?

Upgrade org.apache.linkis:linkis to 1.3.0 or later.

Is CVE-2022-39944 being exploited?

There is no known exploitation of CVE-2022-39944 in the wild and no public exploit code.

Other vulnerabilities in Apache Linkis

• CVE-2023-27602 Apache Linkis publicsercice module unrestricted upload of file Critical 9.8
• CVE-2023-27603 Apache Linkis Mangaer module engineConn material upload exists Zip Slip issue Critical 9.8
• CVE-2023-29215 Apache Linkis JDBC EngineCon has a deserialization command execution Critical 9.8
• CVE-2023-29216 Apache Linkis DatasourceManager module has a deserialization command execution Critical 9.8
• CVE-2023-27987 Apache Linkis gateway module token authentication bypass Critical 9.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3f3w-gmqf-4hj3.