oss-security - CVE-2023-27602: Apache Linkis publicsercice module unrestricted upload of file

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <be3b46f7-0dbf-95cf-b512-1e4a4450763a@apache.org>
Date: Mon, 10 Apr 2023 06:14:37 +0000
From: Heping Wang <peacewong@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2023-27602: Apache Linkis publicsercice module unrestricted
 upload of file 

Severity: important

Description:

In Apache Linkis <=1.3.1, The PublicService module uploads files without restrictions on the path to the uploaded files, and file types.


We recommend users upgrade the version of Linkis to version 1.3.2. 

For versions 

<=1.3.1, we suggest turning on the file path check switch in linkis.properties

`wds.linkis.workspace.filesystem.owner.check=true`
`wds.linkis.workspace.filesystem.path.check=true`

Credit:

Laihan (reporter)

References:

https://linkis.apache.org
https://www.cve.org/CVERecord?id=CVE-2023-27602

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.