oss-security - CVE-2024-31866: Apache Zeppelin: Interpreter download command does not escape malicious code injection

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <d9873fb8-d43b-0233-5272-3afbcf385476@apache.org>
Date: Tue, 09 Apr 2024 14:45:00 +0000
From: Jongyoul Lee <jongyoul@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2024-31866: Apache Zeppelin: Interpreter download command does
 not escape malicious code injection 

Severity: moderate

Affected versions:

- Apache Zeppelin 0.8.2 before 0.11.1

Description:

Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin.

The attackers can execute shell scripts or malicious code by overriding configuration like ZEPPELIN_INTP_CLASSPATH_OVERRIDES.
This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1.

Users are recommended to upgrade to version 0.11.1, which fixes the issue.

Credit:

Esa Hiltunen (finder)
https://teragrep.com (finder)

References:

https://github.com/apache/zeppelin/pull/4715
https://zeppelin.apache.org/
https://www.cve.org/CVERecord?id=CVE-2024-31866

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.