cnvd - cnvd-2022-02487

CNVD-2022-02487

Vulnerability from cnvd - Published: 2022-01-11

Title

Apache Kylin输入验证错误漏洞

Description

Apache Kylin是美国阿帕奇（Apache）基金会的一款开源的分布式分析型数据仓库。该产品主要提供Hadoop/Spark之上的SQL查询接口及多维分析（OLAP）等功能。 Apache kylin 存在输入验证错误漏洞，该漏洞源于Kylin可以接收用户输入并通过class . forname(…)加载任何类。目前没有详细的漏洞细节提供。

Severity

高

Patch Name

Apache Kylin输入验证错误漏洞的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://lists.apache.org/thread/hh5crx3yr701zd8wtpqo1mww2rlkvznw

Reference

https://www.cybersecurity-help.cz/vdb/SB2022010627

Impacted products

Name
['Apache Kylin 2.0.0', 'Apache Kylin 2.1.0', 'Apache Kylin 2.2.0', 'Apache Kylin 2.3.0', 'Apache Kylin 2.3.1', 'Apache Kylin 2.3.2', 'Apache Kylin 2.4.0', 'Apache Kylin 2.4.1', 'Apache Kylin 2.5.0', 'Apache Kylin 2.5.1', 'Apache Kylin 2.5.2', 'Apache Kylin 2.6.1', 'Apache Kylin 2.6.2', 'Apache Kylin 2.6.3', 'Apache Kylin 2.6.4', 'Apache Kylin 2.6.5', 'Apache Kylin 2.6.6', 'Apache Kylin 3.0.0', 'Apache Kylin 3.0.1', 'Apache Kylin 3.0.2', 'Apache Kylin 2.6.0', 'Apache Kylin 3.1.0', 'Apache Kylin 3.1.1', 'Apache Kylin 3.1.2', 'Apache Kylin 4.0.0']

Name

['Apache Kylin 2.0.0', 'Apache Kylin 2.1.0', 'Apache Kylin 2.2.0', 'Apache Kylin 2.3.0', 'Apache Kylin 2.3.1', 'Apache Kylin 2.3.2', 'Apache Kylin 2.4.0', 'Apache Kylin 2.4.1', 'Apache Kylin 2.5.0', 'Apache Kylin 2.5.1', 'Apache Kylin 2.5.2', 'Apache Kylin 2.6.1', 'Apache Kylin 2.6.2', 'Apache Kylin 2.6.3', 'Apache Kylin 2.6.4', 'Apache Kylin 2.6.5', 'Apache Kylin 2.6.6', 'Apache Kylin 3.0.0', 'Apache Kylin 3.0.1', 'Apache Kylin 3.0.2', 'Apache Kylin 2.6.0', 'Apache Kylin 3.1.0', 'Apache Kylin 3.1.1', 'Apache Kylin 3.1.2', 'Apache Kylin 4.0.0']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-31522"
    }
  },
  "description": "Apache Kylin\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u57fa\u91d1\u4f1a\u7684\u4e00\u6b3e\u5f00\u6e90\u7684\u5206\u5e03\u5f0f\u5206\u6790\u578b\u6570\u636e\u4ed3\u5e93\u3002\u8be5\u4ea7\u54c1\u4e3b\u8981\u63d0\u4f9bHadoop/Spark\u4e4b\u4e0a\u7684SQL\u67e5\u8be2\u63a5\u53e3\u53ca\u591a\u7ef4\u5206\u6790\uff08OLAP\uff09\u7b49\u529f\u80fd\u3002\n\nApache kylin \u5b58\u5728\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eKylin\u53ef\u4ee5\u63a5\u6536\u7528\u6237\u8f93\u5165\u5e76\u901a\u8fc7class . forname(\u2026)\u52a0\u8f7d\u4efb\u4f55\u7c7b\u3002 \u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://lists.apache.org/thread/hh5crx3yr701zd8wtpqo1mww2rlkvznw",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2022-02487",
  "openTime": "2022-01-11",
  "patchDescription": "Apache Kylin\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u57fa\u91d1\u4f1a\u7684\u4e00\u6b3e\u5f00\u6e90\u7684\u5206\u5e03\u5f0f\u5206\u6790\u578b\u6570\u636e\u4ed3\u5e93\u3002\u8be5\u4ea7\u54c1\u4e3b\u8981\u63d0\u4f9bHadoop/Spark\u4e4b\u4e0a\u7684SQL\u67e5\u8be2\u63a5\u53e3\u53ca\u591a\u7ef4\u5206\u6790\uff08OLAP\uff09\u7b49\u529f\u80fd\u3002\r\n\r\nApache kylin \u5b58\u5728\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eKylin\u53ef\u4ee5\u63a5\u6536\u7528\u6237\u8f93\u5165\u5e76\u901a\u8fc7class . forname(\u2026)\u52a0\u8f7d\u4efb\u4f55\u7c7b\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Apache Kylin\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Apache Kylin 2.0.0",
      "Apache Kylin 2.1.0",
      "Apache Kylin 2.2.0",
      "Apache Kylin 2.3.0",
      "Apache Kylin 2.3.1",
      "Apache Kylin 2.3.2",
      "Apache Kylin 2.4.0",
      "Apache Kylin 2.4.1",
      "Apache Kylin 2.5.0",
      "Apache Kylin 2.5.1",
      "Apache Kylin 2.5.2",
      "Apache Kylin 2.6.1",
      "Apache Kylin 2.6.2",
      "Apache Kylin 2.6.3",
      "Apache Kylin 2.6.4",
      "Apache Kylin 2.6.5",
      "Apache Kylin 2.6.6",
      "Apache Kylin 3.0.0",
      "Apache Kylin 3.0.1",
      "Apache Kylin 3.0.2",
      "Apache Kylin 2.6.0",
      "Apache Kylin 3.1.0",
      "Apache Kylin 3.1.1",
      "Apache Kylin 3.1.2",
      "Apache Kylin 4.0.0"
    ]
  },
  "referenceLink": "https://www.cybersecurity-help.cz/vdb/SB2022010627",
  "serverity": "\u9ad8",
  "submitTime": "2022-01-10",
  "title": "Apache Kylin\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e"
}

CVE-2021-31522 (GCVE-0-2021-31522)

Vulnerability from cvelistv5 – Published: 2022-01-06 12:35 – Updated: 2024-08-03 23:03

Title

Apache Kylin unsafe class loading

Summary

Kylin can receive user input and load any class through Class.forName(...). This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions.

Severity ?

No CVSS data available.

CWE

load any class

Assigner

apache

References

URL

Tags

	https://lists.apache.org/thread/hh5crx3yr701zd8wt…	x_refsource_MISC
	http://www.openwall.com/lists/oss-security/2022/01/06/4	mailing-listx_refsource_MLIST

Impacted products

	Vendor	Product	Version
	Apache Software Foundation	Apache Kylin	Affected: Apache Kylin 2 , ≤ 2.6.6 (custom) Affected: Apache Kylin 3 , ≤ 3.1.2 (custom) Affected: Apache Kylin 4 , ≤ 4.0.0 (custom)

Credits

bo yu <forhaby0@gmail.com>

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T23:03:33.379Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread/hh5crx3yr701zd8wtpqo1mww2rlkvznw"
          },
          {
            "name": "[oss-security] 20220106 CVE-2021-31522: Apache Kylin unsafe class loading",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/01/06/4"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache Kylin",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "2.6.6",
              "status": "affected",
              "version": "Apache Kylin 2",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "3.1.2",
              "status": "affected",
              "version": "Apache Kylin 3",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.0.0",
              "status": "affected",
              "version": "Apache Kylin 4",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "bo yu \u003cforhaby0@gmail.com\u003e"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Kylin can receive user input and load any class through Class.forName(...). This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "other": "moderate"
            },
            "type": "unknown"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "load any class",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-01-06T15:06:16",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.apache.org/thread/hh5crx3yr701zd8wtpqo1mww2rlkvznw"
        },
        {
          "name": "[oss-security] 20220106 CVE-2021-31522: Apache Kylin unsafe class loading",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/01/06/4"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Kylin unsafe class loading",
      "workarounds": [
        {
          "lang": "en",
          "value": "Users of Kylin 2.x \u0026 Kylin 3.x should upgrade to 3.1.3 or apply patch https://github.com/apache/kylin/pull/1695.\nUsers of Kylin 4.x should upgrade to 4.0.1 or apply patch https://github.com/apache/kylin/pull/1763."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "ID": "CVE-2021-31522",
          "STATE": "PUBLIC",
          "TITLE": "Apache Kylin unsafe class loading"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache Kylin",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "Apache Kylin 2",
                            "version_value": "2.6.6"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "Apache Kylin 3",
                            "version_value": "3.1.2"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "Apache Kylin 4",
                            "version_value": "4.0.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache Software Foundation"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "bo yu \u003cforhaby0@gmail.com\u003e"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Kylin can receive user input and load any class through Class.forName(...). This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": [
          {
            "other": "moderate"
          }
        ],
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "load any class"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://lists.apache.org/thread/hh5crx3yr701zd8wtpqo1mww2rlkvznw",
              "refsource": "MISC",
              "url": "https://lists.apache.org/thread/hh5crx3yr701zd8wtpqo1mww2rlkvznw"
            },
            {
              "name": "[oss-security] 20220106 CVE-2021-31522: Apache Kylin unsafe class loading",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2022/01/06/4"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        },
        "work_around": [
          {
            "lang": "en",
            "value": "Users of Kylin 2.x \u0026 Kylin 3.x should upgrade to 3.1.3 or apply patch https://github.com/apache/kylin/pull/1695.\nUsers of Kylin 4.x should upgrade to 4.0.1 or apply patch https://github.com/apache/kylin/pull/1763."
          }
        ]
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2021-31522",
    "datePublished": "2022-01-06T12:35:18",
    "dateReserved": "2021-04-21T00:00:00",
    "dateUpdated": "2024-08-03T23:03:33.379Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2022-02487

CVE-2021-31522 (GCVE-0-2021-31522)

Tags

Sightings

Nomenclature