~ / search / GHSA-hx5g-8hq2-8x4w

GHSA-hx5g-8hq2-8x4w

SQL Injection in Kylin

Source: GitHub Advisory Database (reviewed) Critical CVE-2020-13926

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.kylin:kylin-server-base < 3.1.0 3.1.0

Details

As written in the advisory (Markdown source, shown as plain text).

Kylin concatenates and executes a Hive SQL in Hive CLI or beeline when building a new segment; some part of the HQL is from system configurations, while the configuration can be overwritten by certain rest api, which makes SQL injection attack is possible. Users of all previous versions after 2.0 should upgrade to 3.1.0.

References

External links from the advisory. They lead to third-party sites.