CVE-2023-34434 | THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

Description

Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0. The attacker could bypass the current logic and achieve arbitrary file reading. To solve it, users are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick https://github.com/apache/inlong/pull/8130 .

Reserved 2023-06-06 | Published 2023-07-25 | Updated 2025-02-13 | Assigner apache

Problem types

CWE-502 Deserialization of Untrusted Data

Product status

Default status

unaffected

1.4.0

affected

Credits

sw0rd1ight and 4ra1n of Chaitin Tech finder

References

lists.apache.org/thread/7f1o71w5r732cspltmtdydn01gllf4jo vendor-advisory

seclists.org/fulldisclosure/2023/Jul/43

www.openwall.com/lists/oss-security/2023/07/25/3

cve.org (CVE-2023-34434)

nvd.nist.gov (CVE-2023-34434)

Download JSON

https://cve.threatint.com/CVE/CVE-2023-34434

Support options

Helpdesk Chat, Email, Knowledgebase

Subscribe to our newsletter to learn more about our work.