Authorization Bypass in Apache InLong
Critical severity
GitHub Reviewed
Published
Oct 16, 2023
to the GitHub Advisory Database
•
Updated Nov 14, 2023
Package
Affected versions
>= 1.4.0, < 1.9.0
Patched versions
1.9.0
Description
Published by the National Vulnerability Database
Oct 16, 2023
Published to the GitHub Advisory Database
Oct 16, 2023
Reviewed
Oct 17, 2023
Last updated
Nov 14, 2023
Authorization Bypass Through User-Controlled Key vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0,
some sensitive params checks will be bypassed, like "autoDeserizalize","allowLoadLocalInfile"....
.
Users are advised to upgrade to Apache InLong's 1.9.0 or cherry-pick [1] to solve it.
[1] apache/inlong#8604
References