CVE-2022-44645 Apache Linkis (incubating): The DatasourceManager module has a serialization attack vulnerability

What is CVE-2022-44645?

CVE-2022-44645 is a high-severity unsafe deserialization vulnerability in Apache Linkis (incubating), published on 31 Jan 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

In Apache Linkis <=1.3.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attacker has write access to a database and configures new datasource with a MySQL data source and malicious parameters. Therefore, the parameters in the jdbc url should be blacklisted. Versions of Apache Linkis <= 1.3.0 will be affected.

We recommend users to upgrade the version of Linkis to version 1.3.1.

Weakness: CWE-502

Which versions are affected by CVE-2022-44645?

2 open source packages ship an affected version, including org.apache.linkis:linkis. It affects 1 product.

Products include Apache Linkis.

How do I fix CVE-2022-44645?

Upgrade org.apache.linkis:linkis to 1.3.1 or later.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2022-44645 being exploited?

There is no known exploitation of CVE-2022-44645 in the wild and no public exploit code.

Other vulnerabilities in Apache Linkis (incubating)

• CVE-2023-27602 Apache Linkis publicsercice module unrestricted upload of file Critical 9.8
• CVE-2023-27603 Apache Linkis Mangaer module engineConn material upload exists Zip Slip issue Critical 9.8
• CVE-2023-29215 Apache Linkis JDBC EngineCon has a deserialization command execution Critical 9.8
• CVE-2023-29216 Apache Linkis DatasourceManager module has a deserialization command execution Critical 9.8
• CVE-2023-27987 Apache Linkis gateway module token authentication bypass Critical 9.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-h6w8-52mq-4qxc.