CVE-2023-37924 Apache Submarine: SQL injection from unauthorized login

What is CVE-2023-37924?

CVE-2023-37924 is a critical vulnerability in Apache Submarine, published on 22 Nov 2023.

Official description

Apache Software Foundation Apache Submarine has an SQL injection vulnerability when a user logs in. This issue can result in unauthorized login. Now we have fixed this issue and now user must have the correct login to access workbench. This issue affects Apache Submarine: from 0.7.0 before 0.8.0. We recommend that all submarine users with 0.7.0 upgrade to 0.8.0, which not only fixes the issue, supports the oidc authentication mode, but also removes the case of unauthenticated logins. If using the version lower than 0.8.0 and not want to upgrade, you can try cherry-pick PR https://github.com/apache/submarine/pull/1037 https://github.com/apache/submarine/pull/1054 and rebuild the submarine-server image to fix this.

Weakness: CWE-89

Which versions are affected by CVE-2023-37924?

3 open source packages ship an affected version, including apache-submarine. It affects 1 product.

Products include Apache Submarine.

How do I fix CVE-2023-37924?

Upgrade apache-submarine to 0.8.0 or later.

Is CVE-2023-37924 being exploited?

There is no known exploitation of CVE-2023-37924 in the wild and no public exploit code.

Other vulnerabilities in Apache Submarine

• CVE-2024-36264 Apache Submarine Commons Utils: default secret Critical 9.8
• CVE-2024-36265 Apache Submarine Server Core: authorization bypass Critical 9.8
• CVE-2023-46302 Apache Submarine: Fix CVE-2022-1471 SnakeYaml unsafe deserialization Critical 9.8
• CVE-2024-36263 Apache Submarine Server Core: SQL injection High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-v5gj-fx3g-hcpw, PYSEC-2023-244.