GHSA-6623-c6mr-6737

Apache Zeppelin: Denial of service with invalid notebook name

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-31862

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.apache.zeppelin:zeppelin-server	>= 0.10.1, < 0.11.0	0.11.0

Details

As written in the advisory (Markdown source, shown as plain text).

Improper Input Validation vulnerability in Apache Zeppelin when creating a new note from Zeppelin's UI. This issue affects Apache Zeppelin from 0.10.1 before 0.11.0. Users are recommended to upgrade to version 0.11.0, which fixes the issue.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-31862 advisory
https://github.com/apache/zeppelin/pull/4632 web
https://github.com/apache/zeppelin/commit/f025a697c1d1d0264064d5adf6cb0b20d85041b6 web
https://github.com/apache/zeppelin package
https://lists.apache.org/thread/73xdjx43yg4yz8bd4p3o8vzyybkysmn0 web
http://www.openwall.com/lists/oss-security/2024/04/09/5 web