=====================================================================

                             CERT-Renater

                 Note d'Information No. 2023/VULN034

_____________________________________________________________________

DATE                : 31/01/2023

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Apache Linkis versions prior
                                     to 1.3.1.

=====================================================================
https://lists.apache.org/thread/hwq9ytq6y1kdh9lz5znptkcrdll9x85h
https://lists.apache.org/thread/zlcfmvt65blqc4n6fxypg6f0ns8fqfz4
_____________________________________________________________________

CVE-2022-44644: Apache Linkis (incubating): The DatasourceManager
module has a Local File Read Vulnerability
Posted to dev@linkis.apache.org
Heping Wang - mardi 31 janvier 2023 08:31:04 UTC+1

Severity: important


Description:

In Apache Linkis <=1.3.0 when used with the MySQL Connector/J,
an authenticated attacker could read arbitrary local file by
connecting a rogue mysql server, By adding allowLoadLocalInfile
to true in the jdbc parameter. Therefore, the parameters in the
jdbc url should be blacklisted. Versions of
Apache Linkis <= 1.3.0 will be affected.

We recommend users upgrade the version of Linkis to version 1.3


Credit:

Department of Cyber Security Research (Jumbo, Unc1e),
Beijing Zhiqian Technology Co., LTD (reporter)
s3gundo of Hundsun Tech  (reporter)


References:

https://linkis.incubator.apache.org
https://www.cve.org/CVERecord?id=CVE-2022-44644

_____________________________________________________________________

CVE-2022-44645: Apache Linkis (incubating): The DatasourceManager
*module has a serialization attack vulnerability
Posted to dev@linkis.apache.org
Heping Wang - mardi 31 janvier 2023 08:31:21 UTC+1

Severity: important


Description:

In Apache Linkis <=1.3.0 when used with the MySQL Connector/J, a
deserialization vulnerability with possible remote code execution
impact exists when an attacker has write access to a database and
configures new datasource with a MySQL data source and malicious
parameters. Therefore, the parameters in the jdbc url should be
blacklisted. Versions of Apache Linkis <= 1.3.0 will be affected.

We recommend users to upgrade the version of Linkis to version
1.3.1.


Credit:

Tian Xin WU (Bearcat) , Vulnerability Researcher at
Numen Cyber Labs, Singapore. (reporter)
Department of Cyber Security Research (Jumbo, Unc1e)
(remediation developer)
s3gundo of Hundsun Tech  (remediation developer)


References:

https://linkis.incubator.apache.org
https://www.cve.org/CVERecord?id=CVE-2022-44645


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================