org.apache.kyuubi:kyuubi-common_2.12@1.9.4

latest version

1.12.0

latest non vulnerable version

1.12.0

first published

5 years ago

latest version published

2 months ago

licenses detected

Apache-2.0
[1.3.0-incubating,)

package registry

View on Maven Central Repository

Go back to all versions of this package

Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the org.apache.kyuubi:kyuubi-common_2.12 package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability Vulnerable Version

Vulnerability	Vulnerable Version
C Directory Traversal Affected versions of this package are vulnerable to Directory Traversal in `Utils.writeToTempFile` in the REST batch multipart upload handling code. An attacker can write controlled content outside the intended upload directory by supplying a multipart filename containing traversal sequences such as `../` in a REST batch upload request. The vulnerable file creation path accepts the client-supplied filename when building the temporary resource path, so a remote user who can reach the REST batch upload endpoint can place files wherever the Kyuubi server process has filesystem permission to write. This can overwrite or create files outside the upload area and break server or host behavior depending on the target path. How to fix Directory Traversal? Upgrade `org.apache.kyuubi:kyuubi-common_2.12` to version 1.12.0 or higher.	[1.7.0,1.12.0)

Directory Traversal

Affected versions of this package are vulnerable to Directory Traversal in Utils.writeToTempFile in the REST batch multipart upload handling code. An attacker can write controlled content outside the intended upload directory by supplying a multipart filename containing traversal sequences such as ../ in a REST batch upload request. The vulnerable file creation path accepts the client-supplied filename when building the temporary resource path, so a remote user who can reach the REST batch upload endpoint can place files wherever the Kyuubi server process has filesystem permission to write. This can overwrite or create files outside the upload area and break server or host behavior depending on the target path.

How to fix Directory Traversal?

Upgrade org.apache.kyuubi:kyuubi-common_2.12 to version 1.12.0 or higher.

[1.7.0,1.12.0)

Go back to all versions of this package