=====================================================================

                                CERT-Renater

                     Note d'Information No. 2023/VULN483

_____________________________________________________________________

DATE                : 27/11/2023

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Apache Submarine versions prior
                                        to 0.8.0.

=====================================================================
https://lists.apache.org/thread/v4of937mkykrm7ow4bhrvcn6kfqgxv03
https://lists.apache.org/thread/r1op8rsdpy45h7m7bhrsk70jy6r3vo67
_____________________________________________________________________

CVE-2023-37924: Apache Submarine: SQL injection from unauthorized
login


Severity: critical

Affected versions:

- Apache Submarine 0.7.0 before 0.8.0

Description:

Apache Software Foundation Apache Submarine has an SQL injection
vulnerability when a user logs in. This issue can result in
unauthorized login.
Now we have fixed this issue and now user must have the correct
login to access workbench.
This issue affects Apache Submarine: from 0.7.0 before 0.8.0. We
recommend that all submarine users with 0.7.0 upgrade to 0.8.0,
which not only fixes the issue, supports the oidc authentication
mode, but also removes the case of unauthenticated logins.

If using the version lower than 0.8.0 and not want to upgrade,
you can try cherry-pick PR https://github.com/apache/submarine/pull/1037
https://github.com/apache/submarine/pull/1054
and rebuild the submarine-server image to fix this.

This issue is being tracked as SUBMARINE-1361

Credit:

lengjingqicai(棱镜七彩开源安全研究院) (reporter)


References:

https://issues.apache.org/jira/browse/SUBMARINE-1361
https://github.com/apache/submarine/pull/1037
https://submarine.apache.org/
https://www.cve.org/CVERecord?id=CVE-2023-37924
https://issues.apache.org/jira/browse/SUBMARINE-1361


_____________________________________________________________________

CVE-2023-46302: Apache Submarine: Fix CVE-2022-1471 SnakeYaml unsafe
deserialization


Severity: critical

Affected versions:

- Apache Submarine 0.7.0 before 0.8.0

Description:

Apache Software Foundation Apache Submarine has a bug when
serializing against yaml. The bug is caused by snakeyaml
https://nvd.nist.gov/vuln/detail/CVE-2022-1471 .

Apache Submarine uses JAXRS to define REST endpoints.  In order to
handle YAML requests (using application/yaml content-type), it
defines a YamlEntityProvider entity provider that will process all
incoming YAML requests.  In order to unmarshal the request, the
readFrom method is invoked, passing the entityStream containing
the user-supplied data in
`submarine-server/server-core/src/main/java/org/apache/submarine/server/utils/YamlUtils.java`.
  We have now fixed this issue in the new version by replacing
to `jackson-dataformat-yaml`.
This issue affects Apache Submarine: from 0.7.0 before 0.8.0.
Users are recommended to upgrade to version 0.8.0, which fixes
this issue.

If using the version smaller than 0.8.0  and not want to upgrade,
you can try cherry-pick PR
https://github.com/apache/submarine/pull/1054  and rebuild the
submart-server image to fix this.

This issue is being tracked as SUBMARINE-1371

Credit:

GHSL team member @jorgectf (Jorge Rosillo) (reporter)


References:

https://issues.apache.org/jira/browse/SUBMARINE-1371
https://github.com/apache/submarine/pull/1054
https://submarine.apache.org/
https://www.cve.org/CVERecord?id=CVE-2023-46302
https://issues.apache.org/jira/browse/SUBMARINE-1371

=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================