{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-39928", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2024-07-04T10:29:50.346Z", "datePublished": "2024-09-24T07:27:55.376Z", "dateUpdated": "2024-09-24T15:02:39.880Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.linkis:linkis-engineplugin-spark", "product": "Apache Linkis Spark EngineConn", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "1.6.0", "status": "affected", "version": "1.3.0", "versionType": "maven"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Hen"}, {"lang": "en", "type": "reporter", "value": "Pj fanning"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "In Apache Linkis &lt;= 1.5.0, a Random string security vulnerability in Spark EngineConn,&nbsp;random string generated by the Token when starting Py4j uses the Commons Lang's RandomStringUtils.<br>Users are recommended to upgrade to version 1.6.0, which fixes this issue."}], "value": "In Apache Linkis <= 1.5.0, a Random string security vulnerability in Spark EngineConn,\u00a0random string generated by the Token when starting Py4j uses the Commons Lang's RandomStringUtils.\nUsers are recommended to upgrade to version 1.6.0, which fixes this issue."}], "metrics": [{"other": {"content": {"text": "moderate"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-326", "description": "CWE-326 Inadequate Encryption Strength", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2024-09-24T07:27:55.376Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/g664n13nb17rsogcfrn8kjgd8m89p8nw"}], "source": {"discovery": "UNKNOWN"}, "title": "Apache Linkis Spark EngineConn: Commons Lang's RandomStringUtils Random string security vulnerability", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-326", "lang": "en", "description": "CWE-326 Inadequate Encryption Strength"}]}], "affected": [{"vendor": "apache_software_foundation", "product": "apache_linkis_spark_engineconn", "cpes": ["cpe:2.3:a:apache_software_foundation:apache_linkis_spark_engineconn:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "13.0", "status": "affected", "lessThan": "1.6.0", "versionType": "maven"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-09-24T13:26:16.429809Z", "id": "CVE-2024-39928", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-24T13:30:21.385Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2024/09/24/2"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-09-24T15:02:39.880Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2024/09/24/2"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-09-24T15:02:39.880Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-39928", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-24T13:26:16.429809Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:apache_software_foundation:apache_linkis_spark_engineconn:*:*:*:*:*:*:*:*"], "vendor": "apache_software_foundation", "product": "apache_linkis_spark_engineconn", "versions": [{"status": "affected", "version": "13.0", "lessThan": "1.6.0", "versionType": "maven"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-326", "description": "CWE-326 Inadequate Encryption Strength"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-24T13:30:13.775Z"}}], "cna": {"title": "Apache Linkis Spark EngineConn: Commons Lang's RandomStringUtils Random string security vulnerability", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Hen"}, {"lang": "en", "type": "reporter", "value": "Pj fanning"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Linkis Spark EngineConn", "versions": [{"status": "affected", "version": "1.3.0", "lessThan": "1.6.0", "versionType": "maven"}], "packageName": "org.apache.linkis:linkis-engineplugin-spark", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread/g664n13nb17rsogcfrn8kjgd8m89p8nw", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "In Apache Linkis <= 1.5.0, a Random string security vulnerability in Spark EngineConn,\u00a0random string generated by the Token when starting Py4j uses the Commons Lang's RandomStringUtils.\nUsers are recommended to upgrade to version 1.6.0, which fixes this issue.", "supportingMedia": [{"type": "text/html", "value": "In Apache Linkis &lt;= 1.5.0, a Random string security vulnerability in Spark EngineConn,&nbsp;random string generated by the Token when starting Py4j uses the Commons Lang's RandomStringUtils.<br>Users are recommended to upgrade to version 1.6.0, which fixes this issue.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-326", "description": "CWE-326 Inadequate Encryption Strength"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2024-09-24T07:27:55.376Z"}}}, "cveMetadata": {"cveId": "CVE-2024-39928", "state": "PUBLISHED", "dateUpdated": "2024-09-24T15:02:39.880Z", "dateReserved": "2024-07-04T10:29:50.346Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2024-09-24T07:27:55.376Z", "assignerShortName": "apache"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:linkis:*:*:*:*:*:*:*:*", "matchCriteriaId": "B58052DA-860C-4D7E-A523-E15306D5B6AF", "versionEndExcluding": "1.6.0", "versionStartIncluding": "1.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Apache Linkis <= 1.5.0, a Random string security vulnerability in Spark EngineConn,\u00a0random string generated by the Token when starting Py4j uses the Commons Lang's RandomStringUtils.\nUsers are recommended to upgrade to version 1.6.0, which fixes this issue."}, {"lang": "es", "value": "En Apache Linkis &lt;= 1.5.0, existe una vulnerabilidad de seguridad de cadenas aleatorias en Spark EngineConn. La cadena aleatoria generada por el token al iniciar Py4j utiliza RandomStringUtils de Commons Lang. Se recomienda a los usuarios actualizar a la versi\u00f3n 1.6.0, que soluciona este problema."}], "id": "CVE-2024-39928", "lastModified": "2025-05-16T20:27:25.980", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-09-25T01:15:40.693", "references": [{"source": "security@apache.org", "tags": ["Vendor Advisory", "Mailing List"], "url": "https://lists.apache.org/thread/g664n13nb17rsogcfrn8kjgd8m89p8nw"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2024/09/24/2"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-326"}], "source": "security@apache.org", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-326"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}