Search
Find a vulnerability
Search criteria
2 vulnerabilities found for Apache Linkis Spark EngineConn by Apache Software Foundation
CVE-2024-39928 (GCVE-0-2024-39928)
Vulnerability from nvd – Published: 2024-09-24 07:27 – Updated: 2024-09-24 15:02
VLAI
Title
Apache Linkis Spark EngineConn: Commons Lang's RandomStringUtils Random string security vulnerability
Summary
In Apache Linkis <= 1.5.0, a Random string security vulnerability in Spark EngineConn, random string generated by the Token when starting Py4j uses the Commons Lang's RandomStringUtils.
Users are recommended to upgrade to version 1.6.0, which fixes this issue.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-326 - Inadequate Encryption Strength
Assigner
References
2 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Linkis Spark EngineConn |
Affected:
1.3.0 , < 1.6.0
(maven)
|
|
| apache_software_foundation | apache_linkis_spark_engineconn |
Affected:
13.0 , < 1.6.0
(maven)
cpe:2.3:a:apache_software_foundation:apache_linkis_spark_engineconn:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:apache_software_foundation:apache_linkis_spark_engineconn:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "apache_linkis_spark_engineconn",
"vendor": "apache_software_foundation",
"versions": [
{
"lessThan": "1.6.0",
"status": "affected",
"version": "13.0",
"versionType": "maven"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-39928",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-24T13:26:16.429809Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-326",
"description": "CWE-326 Inadequate Encryption Strength",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-24T13:30:21.385Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-09-24T15:02:39.880Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2024/09/24/2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.linkis:linkis-engineplugin-spark",
"product": "Apache Linkis Spark EngineConn",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "1.6.0",
"status": "affected",
"version": "1.3.0",
"versionType": "maven"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Hen"
},
{
"lang": "en",
"type": "reporter",
"value": "Pj fanning"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "In Apache Linkis \u0026lt;= 1.5.0, a Random string security vulnerability in Spark EngineConn,\u0026nbsp;random string generated by the Token when starting Py4j uses the Commons Lang\u0027s RandomStringUtils.\u003cbr\u003eUsers are recommended to upgrade to version 1.6.0, which fixes this issue."
}
],
"value": "In Apache Linkis \u003c= 1.5.0, a Random string security vulnerability in Spark EngineConn,\u00a0random string generated by the Token when starting Py4j uses the Commons Lang\u0027s RandomStringUtils.\nUsers are recommended to upgrade to version 1.6.0, which fixes this issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-326",
"description": "CWE-326 Inadequate Encryption Strength",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-24T07:27:55.376Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/g664n13nb17rsogcfrn8kjgd8m89p8nw"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache Linkis Spark EngineConn: Commons Lang\u0027s RandomStringUtils Random string security vulnerability",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2024-39928",
"datePublished": "2024-09-24T07:27:55.376Z",
"dateReserved": "2024-07-04T10:29:50.346Z",
"dateUpdated": "2024-09-24T15:02:39.880Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-39928 (GCVE-0-2024-39928)
Vulnerability from cvelistv5 – Published: 2024-09-24 07:27 – Updated: 2024-09-24 15:02
VLAI
Title
Apache Linkis Spark EngineConn: Commons Lang's RandomStringUtils Random string security vulnerability
Summary
In Apache Linkis <= 1.5.0, a Random string security vulnerability in Spark EngineConn, random string generated by the Token when starting Py4j uses the Commons Lang's RandomStringUtils.
Users are recommended to upgrade to version 1.6.0, which fixes this issue.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-326 - Inadequate Encryption Strength
Assigner
References
2 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Linkis Spark EngineConn |
Affected:
1.3.0 , < 1.6.0
(maven)
|
|
| apache_software_foundation | apache_linkis_spark_engineconn |
Affected:
13.0 , < 1.6.0
(maven)
cpe:2.3:a:apache_software_foundation:apache_linkis_spark_engineconn:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:apache_software_foundation:apache_linkis_spark_engineconn:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "apache_linkis_spark_engineconn",
"vendor": "apache_software_foundation",
"versions": [
{
"lessThan": "1.6.0",
"status": "affected",
"version": "13.0",
"versionType": "maven"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-39928",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-24T13:26:16.429809Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-326",
"description": "CWE-326 Inadequate Encryption Strength",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-24T13:30:21.385Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-09-24T15:02:39.880Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2024/09/24/2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.linkis:linkis-engineplugin-spark",
"product": "Apache Linkis Spark EngineConn",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "1.6.0",
"status": "affected",
"version": "1.3.0",
"versionType": "maven"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Hen"
},
{
"lang": "en",
"type": "reporter",
"value": "Pj fanning"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "In Apache Linkis \u0026lt;= 1.5.0, a Random string security vulnerability in Spark EngineConn,\u0026nbsp;random string generated by the Token when starting Py4j uses the Commons Lang\u0027s RandomStringUtils.\u003cbr\u003eUsers are recommended to upgrade to version 1.6.0, which fixes this issue."
}
],
"value": "In Apache Linkis \u003c= 1.5.0, a Random string security vulnerability in Spark EngineConn,\u00a0random string generated by the Token when starting Py4j uses the Commons Lang\u0027s RandomStringUtils.\nUsers are recommended to upgrade to version 1.6.0, which fixes this issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-326",
"description": "CWE-326 Inadequate Encryption Strength",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-24T07:27:55.376Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/g664n13nb17rsogcfrn8kjgd8m89p8nw"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache Linkis Spark EngineConn: Commons Lang\u0027s RandomStringUtils Random string security vulnerability",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2024-39928",
"datePublished": "2024-09-24T07:27:55.376Z",
"dateReserved": "2024-07-04T10:29:50.346Z",
"dateUpdated": "2024-09-24T15:02:39.880Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}