{"id":"CVE-2024-26579","published":"2024-05-08T15:06:23Z","modified":"2025-03-28T18:52:24Z","title":"Apache Inlong JDBC Vulnerability","vendor":"Apache","product":"Apache InLong","tier":"tail","description":{"text":"Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.7.0 through 1.11.0, \n\n the attackers can bypass using malicious parameters.\n\nUsers are advised to upgrade to Apache InLong's 1.12.0 or cherry-pick [1], [2] to solve it.\n\n[1]  https://github.com/apache/inlong/pull/9694 \n\n[2]  https://github.com/apache/inlong/pull/9707","provenance":"source","from":"CVE.org"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.01139,"percentile":0.66573,"provenance":"source"},"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"references":[{"url":"https://lists.apache.org/thread/d2hndtvh6bll4pkl91o2oqxyynhr54k3","tags":["vendor-advisory"]},{"url":"https://github.com/advisories/GHSA-fgh3-pwmp-3qw3","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2024/05/09/2","tags":[]}],"priority":{"score":20.2,"factors":[{"name":"EPSS percentile","points":13.31},{"name":"CVSS severity","points":6.86}]},"vendorSlug":"apache","affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache InLong","versions":[">= 1.7.0, <= 1.11"]}],"affected":[{"ecosystem":"Maven","package":"org.apache.inlong:manager-pojo","vulnerableRanges":[">=1.7.0, <1.12.0"],"patched":["1.12.0"],"from":["GHSA-fgh3-pwmp-3qw3"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-1601","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-apache-inlong-cve-2023-34434","parents":[{"from":"CVE-2023-51785","to":"CVE-2024-26579","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.inlong:manager-pojo","fromFixed":"1.10.0","toFixed":"1.12.0","daysApart":126},{"kind":"same-code","provenance":"machine","files":["inlong-manager/manager-pojo/src/main/java/org/apache/inlong/manager/pojo/util/MySQLSensitiveUrlUtils.java"],"commits":["https://github.com/apache/inlong/commit/d674bfe28416aff728eabafc1f6b8bb9ba5a5b8e","https://github.com/apache/inlong/commit/23e3e00cae1fd120b089fca54f7440945dfe11a4","https://github.com/apache/inlong/commit/cdf616670942fec7d09fae2452e2ea215205dd1d"],"basis":"rarely changed file"},{"kind":"similar","provenance":"machine","score":0.48,"basis":"same product + CWE + description similarity"}]}],"children":[{"from":"CVE-2024-26579","to":"CVE-2025-27522","relation":"bypass","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"bypass","quote":"This vulnerability is a secondary mining bypass for CVE-2024-26579.","from":"CVE.org","in":"CVE-2025-27522"},{"kind":"same-code","provenance":"machine","files":["inlong-manager/manager-pojo/src/main/java/org/apache/inlong/manager/pojo/util/MySQLSensitiveUrlUtils.java"],"commits":["https://github.com/apache/inlong/commit/23e3e00cae1fd120b089fca54f7440945dfe11a4","https://github.com/apache/inlong/commit/cdf616670942fec7d09fae2452e2ea215205dd1d","https://github.com/apache/inlong/commit/86c893cfd8f7ba9ffce5d20abef6cd360f502fdf"],"basis":"shared function","functions":["filterSensitive"]},{"kind":"similar","provenance":"machine","score":0.45,"basis":"same product + CWE + description similarity"}]}],"packageHistory":[{"cve":"CVE-2023-46227","published":"2023-10-19","fixed":"1.9.0","kev":false},{"cve":"CVE-2023-51784","published":"2024-01-03","fixed":"1.10.0","kev":false},{"cve":"CVE-2023-51785","published":"2024-01-03","fixed":"1.10.0","kev":false},{"cve":"CVE-2024-26579","published":"2024-05-08","fixed":"1.12.0","kev":false},{"cve":"CVE-2023-31098","published":"2023-05-22","fixed":"1.47.0","kev":false},{"cve":"CVE-2025-27522","published":"2025-05-28","fixed":"2.2.0","kev":false},{"cve":"CVE-2025-27526","published":"2025-05-28","fixed":"2.2.0","kev":false}],"package":"Maven:org.apache.inlong:manager-pojo"}}