GHSA-wh73-hpcg-v32j

SQL injection in apache-superset

Source: GitHub Advisory Database (reviewed) Critical CVE-2022-27479

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	apache-superset	< 1.4.2	1.4.2

Details

As written in the advisory (Markdown source, shown as plain text).

Apache Superset before 1.4.2 is vulnerable to SQL injection in chart data requests. Users should update to 1.4.2 or higher which addresses this issue.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-27479 advisory
https://github.com/advisories/GHSA-wh73-hpcg-v32j advisory
https://github.com/apache/superset package
https://github.com/pypa/advisory-database/tree/main/vulns/apache-superset/PYSEC-2022-188.yaml web
https://lists.apache.org/thread/94th50j5d0y2fw7ysx0g7w3t6jk3z7q6 web
https://lists.apache.org/thread/ztb9b6jd9rngoxwvq8r4fhpp401o613y web
http://www.openwall.com/lists/oss-security/2022/04/13/3 web