GHSA-qmr3-52xf-wmhx

Apache Zeppelin: LDAP search filter query Injection Vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-31867

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.apache.zeppelin:zeppelin-server	>= 0.8.2, < 0.11.1	0.11.1

Details

As written in the advisory (Markdown source, shown as plain text).

Improper Input Validation vulnerability in Apache Zeppelin. The attackers can execute malicious queries by setting improper configuration properties to LDAP search filter. This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1. Users are recommended to upgrade to version 0.11.1, which fixes the issue.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-31867 advisory
https://github.com/apache/zeppelin/pull/4714 web
https://github.com/apache/zeppelin/commit/65d0bcc1ee8ec3ec372d0a71ab513cd20e6522a0 web
https://github.com/apache/zeppelin package
https://lists.apache.org/thread/s4scw8bxdhrjs0kg0lhb68xqd8y9lrtf web
http://www.openwall.com/lists/oss-security/2024/04/09/12 web