CVE-2020-1956Apache Kylin OS Command Injection Vulnerability

Descripción

Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• https://lists.apache.org/thread.html/r1332ef34cf8e2c0589cf44ad269fb1fb4c06addec6297f0320f5111d%40%3Cuser.kyli… Mailing ListMitigationVendor Advisory
• https://community.sonarsource.com/t/apache-kylin-3-0-1-command-injection-vulnerability/25706 ExploitThird Party Advisory
• [kylin-user] 20200713 [SECURITY][CVE-2020-13925] Apache Kylin command injection vulnerability mailing-listMailing List
• [kylin-dev] 20200713 [SECURITY][CVE-2020-13925] Apache Kylin command injection vulnerability mailing-listMailing List
• [kylin-commits] 20200713 svn commit: r1879845 - in /kylin/site: docs/security.html feed.xml mailing-listMailing ListPatch
• [announce] 20200713 [SECURITY][CVE-2020-13925] Apache Kylin command injection vulnerability mailing-listMailing List
• [oss-security] 20200714 [SECURITY][CVE-2020-13925] Apache Kylin command injection vulnerability mailing-listMailing List
• [kylin-commits] 20200715 svn commit: r1879879 - in /kylin/site: docs/security.html feed.xml mailing-listMailing ListPatch
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1956 Third Party AdvisoryUS Government Resource