org.apache.iotdb:iotdb-core 2.0.8

Direct Vulnerabilities

Known vulnerabilities in the org.apache.iotdb:iotdb-core package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Incorrect Authorization Affected versions of this package are vulnerable to Incorrect Authorization in `fastLastQuery` of the `/rest/v2/fastLastQuery` endpoint. An attacker can access last-value data belonging to other users by sending crafted requests while authenticated, bypassing intended authorization controls. How to fix Incorrect Authorization? Upgrade `org.apache.iotdb:iotdb-core` to version 1.3.8, 2.0.10 or higher.	[1.3.5,1.3.8)[2.0.5,2.0.10)
H Memory Allocation with Excessive Size Value Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the `readLength` parameter when `pipe_air_gap_receiver_enabled` is set to true. An attacker can exhaust heap memory and cause the DataNode process to crash or become severely degraded by sending unauthenticated TCP connections with attacker-controlled large allocation requests to port 9780. How to fix Memory Allocation with Excessive Size Value? Upgrade `org.apache.iotdb:iotdb-core` to version 2.0.10 or higher.	[1.0.0,2.0.10)
H Uncontrolled Recursion Affected versions of this package are vulnerable to Uncontrolled Recursion via the `readLength` function. An attacker can exhaust the receiver thread's JVM stack and cause a StackOverflowError by sending a stream of repeated E-language prefixes to the socket, resulting in unbounded recursion. Note: This is only exploitable if the configuration setting `pipe_air_gap_receiver_enabled` is set to true. How to fix Uncontrolled Recursion? Upgrade `org.apache.iotdb:iotdb-core` to version 2.0.10 or higher.	[1.0.0,2.0.10)

Vulnerability

Vulnerable Version

Incorrect Authorization

Affected versions of this package are vulnerable to Incorrect Authorization in fastLastQuery of the /rest/v2/fastLastQuery endpoint. An attacker can access last-value data belonging to other users by sending crafted requests while authenticated, bypassing intended authorization controls.

How to fix Incorrect Authorization?

Upgrade org.apache.iotdb:iotdb-core to version 1.3.8, 2.0.10 or higher.

[1.3.5,1.3.8)[2.0.5,2.0.10)

Memory Allocation with Excessive Size Value

Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the readLength parameter when pipe_air_gap_receiver_enabled is set to true. An attacker can exhaust heap memory and cause the DataNode process to crash or become severely degraded by sending unauthenticated TCP connections with attacker-controlled large allocation requests to port 9780.

How to fix Memory Allocation with Excessive Size Value?

Upgrade org.apache.iotdb:iotdb-core to version 2.0.10 or higher.

[1.0.0,2.0.10)

Uncontrolled Recursion

Affected versions of this package are vulnerable to Uncontrolled Recursion via the readLength function. An attacker can exhaust the receiver thread's JVM stack and cause a StackOverflowError by sending a stream of repeated E-language prefixes to the socket, resulting in unbounded recursion.

Note: This is only exploitable if the configuration setting pipe_air_gap_receiver_enabled is set to true.

How to fix Uncontrolled Recursion?

Upgrade org.apache.iotdb:iotdb-core to version 2.0.10 or higher.

[1.0.0,2.0.10)

org.apache.iotdb:iotdb-core@2.0.8

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically