Ce mail provient de l'extérieur, restons vigilants

=====================================================================

                            CERT-Renater

                Note d'Information No. 2025/VULN498
_____________________________________________________________________

DATE                : 11/08/2025

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Apache Zeppelin versions prior
                                      to 0.12.0.

=====================================================================
https://lists.apache.org/thread/nwh8vh9f3pnvt04n8z4g2kbddh62blr6
https://lists.apache.org/thread/bckm4y2ld5k5ro7bwh5yxbpxvslw0lm6
https://lists.apache.org/thread/dxb98vgrb21rrl3k0fzonpk66onr6o4q
_____________________________________________________________________

CVE-2024-52279: Apache Zeppelin: Arbitrary file read by adding
malicious JDBC connection string

Severity: moderate 

Affected versions:

- Apache Zeppelin (org.apache.zeppelin:zeppelin-jdbc) 0.11.1 before
0.12.0


Description:

Improper Input Validation vulnerability in Apache Zeppelin. The fix
for JDBC URL validation in CVE-2024-31864 did not account for URL
encoded input.

This issue affects Apache Zeppelin: from 0.11.1 before 0.12.0.

Users are recommended to upgrade to version 0.12.0, which fixes the
issue.


Credit:

H Ming (finder)


References:

https://github.com/apache/zeppelin/pull/4838
https://issues.apache.org/jira/browse/ZEPPELIN-6095
https://www.cve.org/CVERecord?id=CVE-2024-31864
https://zeppelin.apache.org/
https://www.cve.org/CVERecord?id=CVE-2024-52279

_____________________________________________________________________

CVE-2024-51775: Apache Zeppelin: Command Injection via CSWSH
Severity: moderate 

Affected versions:

- Apache Zeppelin (org.apache.zeppelin:zeppelin-shell) 0.11.1 before
0.12.0

Description:

Missing Origin Validation in WebSockets vulnerability in Apache
Zeppelin.

The attacker could access the Zeppelin server from another origin
without any restriction, and get internal information about
paragraphs. 

This issue affects Apache Zeppelin: from 0.11.1 before 0.12.0.

Users are recommended to upgrade to version 0.12.0, which fixes
the issue.


Credit:

Calum Hutton (finder)


References:

https://github.com/apache/zeppelin/pull/4823
https://zeppelin.apache.org/
https://www.cve.org/CVERecord?id=CVE-2024-51775

_____________________________________________________________________

CVE-2024-52279: Apache Zeppelin: Arbitrary file read by adding
malicious JDBC connection string

Severity: moderate 

Affected versions:

- Apache Zeppelin (org.apache.zeppelin:zeppelin-jdbc) 0.11.1 before
0.12.0


Description:

Improper Input Validation vulnerability in Apache Zeppelin. The fix
for JDBC URL validation in CVE-2024-31864 did not account for URL
encoded input.

This issue affects Apache Zeppelin: from 0.11.1 before 0.12.0.

Users are recommended to upgrade to version 0.12.0, which fixes
the issue.


Credit:

H Ming (finder)


References:

https://github.com/apache/zeppelin/pull/4838
https://issues.apache.org/jira/browse/ZEPPELIN-6095
https://www.cve.org/CVERecord?id=CVE-2024-31864
https://zeppelin.apache.org/
https://www.cve.org/CVERecord?id=CVE-2024-52279


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================