GHSA-86jx-wr74-xr74

Improper escaping in Apache Zeppelin

Source: GitHub Advisory Database (reviewed) Critical CVE-2024-31866

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.apache.zeppelin:zeppelin-interpreter	>= 0.8.2, < 0.11.1	0.11.1

Details

As written in the advisory (Markdown source, shown as plain text).

Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin. The attackers can execute shell scripts or malicious code by overriding configuration like ZEPPELIN_INTP_CLASSPATH_OVERRIDES. This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1. Users are recommended to upgrade to version 0.11.1, which fixes the issue.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-31866 advisory
https://github.com/apache/zeppelin/pull/4715 web
https://github.com/apache/zeppelin/commit/dd08a3966ef3b0b40f13d0291d7cac5ec3dd9f9c web
https://github.com/apache/zeppelin package
https://lists.apache.org/thread/jpkbq3oktopt34x2n5wnhzc2r1410ddd web
http://www.openwall.com/lists/oss-security/2024/04/09/10 web