Open-source package vulnerability · Maven

CVE-2024-31866: Improper escaping in Apache Zeppelin

criticalCVSS 4.0 9.3 · 3.1 9.8GHSA-86jx-wr74-xr74

Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin. The attackers can execute shell scripts or malicious code by overriding configuration like ZEPPELININTPCLASSPATHOVERRIDES. This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1. Users are recommended to upgrade to version 0.11.1, which fixes the issue.

Published Apr 9, 2024 · Updated Aug 21, 2024

Affected packages

org.apache.zeppelin:zeppelin-interpreter

Ecosystem: Maven
Affected: >= 0.8.2, < 0.11.1
Fixed in: 0.11.1
Check: mvn dependency:tree -Dincludes=org.apache.zeppelin:zeppelin-interpreter

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin.

The attackers can execute shell scripts or malicious code by overriding configuration like ZEPPELIN_INTP_CLASSPATH_OVERRIDES. This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1.

Users are recommended to upgrade to version 0.11.1, which fixes the issue.

Credited to raboof.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology