Code injection in Apache Zeppelin Shell

published 2024-04-11 2y ago modified 2024-12-03 last yr. also CVE-2024-31861

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Zeppelin.

The attackers can use Shell interpreter as a code generation gateway, and execute the generated code as a normal way. This issue affects Apache Zeppelin: from 0.10.1 before 0.11.1.

Users are recommended to upgrade to version 0.11.1, which doesn't have Shell interpreter by default.

Patch / fix

fixed in 1 links 1

maven org.apache.zeppelin:zeppelin-shell 0.11.1

github.com/apache/zeppelin#4708 pull request

Is GHSA-8pfj-w89w-m24x in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
maven	org.apache.zeppelin:zeppelin-shell	>=0.10.1, <0.11.1	0.11.1

Classification

Weakness

CWE-94 Improper Control of Generation of Code

References

github.com /apache/zeppelin/pull/4708
web
nvd.nist.gov /vuln/detail/CVE-2024-31861
advisory
github.com /apache/zeppelin
package
lists.apache.org /thread/99clvqrht5l5r6kzjzwg2kj94boc9sfh
web
openwall.com /lists/oss-security/2024/04/10/8
web

Sources

GitHub Advisory GHSA-8pfj-w89w-m24x

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.