What is GHSA-fgh3-pwmp-3qw3?

GHSA-fgh3-pwmp-3qw3 is a security advisory published by GitHub Security Advisories with Critical severity. Apache Inlong Deserialization of Untrusted Data vulnerability

Which CVE IDs does GHSA-fgh3-pwmp-3qw3 cover?

GHSA-fgh3-pwmp-3qw3 covers the following CVE IDs: CVE-2024-26579. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-fgh3-pwmp-3qw3?

GHSA-fgh3-pwmp-3qw3 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-fgh3-pwmp-3qw3?

GHSA-fgh3-pwmp-3qw3 affects 1 product, including: maven/org.apache.inlong:manager-pojo:\u003e= 1.7.0, \u003c 1.12.0.

GHSA-fgh3-pwmp-3qw3CriticalCVSS 9.8

Apache Inlong Deserialization of Untrusted Data vulnerability

Vendor

GitHub Security Advisories

Published

May 8, 2024

Last Modified

February 11, 2025

🔗 CVE IDs covered (1)

CVE-2024-26579 →

📋 Description

Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.7.0 through 1.11.0. The attackers can bypass using malicious parameters.

Users are advised to upgrade to Apache InLong's 1.12.0 or cherry-pick [1], [2] to solve it.

[1] https://github.com/apache/inlong/pull/9694

[2] https://github.com/apache/inlong/pull/9707

🎯 Affected products1

maven/org.apache.inlong:manager-pojo:>= 1.7.0, < 1.12.0

🔗 References (8)

https://nvd.nist.gov/vuln/detail/CVE-2024-26579
https://lists.apache.org/thread/d2hndtvh6bll4pkl91o2oqxyynhr54k3
https://github.com/apache/inlong/pull/9694
https://github.com/apache/inlong/pull/9707
https://github.com/apache/inlong/commit/23e3e00cae1fd120b089fca54f7440945dfe11a4
https://github.com/apache/inlong/commit/cdf616670942fec7d09fae2452e2ea215205dd1d
https://github.com/advisories/GHSA-fgh3-pwmp-3qw3
http://www.openwall.com/lists/oss-security/2024/05/09/2