CVE-2022-43396 — Incomplete List of Disallowed Inputs in Apache Kylin

CWE-184 — Incomplete List of Disallowed InputsCWE-77 — Command InjectionCWE-20 — Improper Input Validation6 documents6 sources
Severity
8.8HIGHNVD
CNA9.8GHSA9.8OSV9.8
EPSS
0.4%
top 40.10%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache KylinApache Software Foundation Apache Kylin
Timeline
PublishedDec 30

Description

In the fix for CVE-2022-24697, a blacklist is used to filter user input commands. But there is a risk of being bypassed. The user can control the command by controlling the kylin.engine.spark-cmd parameter of conf.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶NVDapache/kylin< 4.0.3
▶CVEListV5apache_software_foundation/apache_kylinApache Kylin 4 — 4.0.2

Patches

Patch: lists.apache.org ↗Patch: lists.apache.org ↗

🔴Vulnerability Details

3
GHSA
Apache Kylin vulnerable to Command injection by Useless configuration↗2022-12-30
▶
CVEList
Apache Kylin: Command injection by Useless configuration↗2022-12-30
▶
OSV
Apache Kylin vulnerable to Command injection by Useless configuration↗2022-12-30
▶

📋Vendor Advisories

2
Microsoft
In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34 remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an interna↗2021-11-09
▶
Red Hat
glibc: conversion from ISO-2022-JP-3 with iconv may emit spurious NUL character on state reset↗2021-11-01
▶
CVE-2022-43396 — Incomplete List of Disallowed Inputs | cvebase