Apache Linkis 1.5.0: EngineConn RandomStringUtils Token flaw
CVE-2024-39928 Published on September 25, 2024

Apache Linkis Spark EngineConn: Commons Lang's RandomStringUtils Random string security vulnerability
In Apache Linkis <= 1.5.0, a Random string security vulnerability in Spark EngineConn, random string generated by the Token when starting Py4j uses the Commons Lang's RandomStringUtils. Users are recommended to upgrade to version 1.6.0, which fixes this issue.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2024-39928 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
NONE
Availability Impact:
NONE

Weakness Type

Inadequate Encryption Strength

The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required. A weak encryption scheme can be subjected to brute force attacks that have a reasonable chance of succeeding using current attack methods and resources.


Products Associated with CVE-2024-39928

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2024-39928 are published in these products:

Apache Linkis
 
Apache Spark
 

Affected Versions

Apache Software Foundation Apache Linkis Spark EngineConn: apache_software_foundation apache_linkis_spark_engineconn:

Exploit Probability

EPSS
0.16%
Percentile
36.56%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.