CVE-2025-27522 - Vulnerability Details - OpenCVE

Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability is a secondary mining bypass for CVE-2024-26579. Users are advised to upgrade to Apache InLong's 2.2.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/11732

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Apache	Inlong

Configuration 1 [-]

cpe:2.3:a:apache:inlong:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/apache/inlong/pull/11732
https://lists.apache.org/thread/s4dnmq3gwcjocxf85qk190knlzd26jby

History

Tue, 03 Jun 2025 14:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Apache Apache inlong
CPEs		cpe:2.3:a:apache:inlong::::::::
Vendors & Products		Apache Apache inlong

Wed, 28 May 2025 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 28 May 2025 08:15:00 +0000

Type	Values Removed	Values Added
Description		Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability is a secondary mining bypass for CVE-2024-26579. Users are advised to upgrade to Apache InLong's 2.2.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/11732
Title		Apache InLong: JDBC Vulnerability during verification processing
Weaknesses		CWE-502
References		https://github.com/apache/inlong/pull/11732 https://lists.apache.org/thread/s4dnmq3gwcjocxf85qk190knlzd26jby

MITRE

Status: PUBLISHED

Assigner: apache

Published: 2025-05-28T08:06:04.191Z

Updated: 2025-05-28T13:59:51.264Z

Reserved: 2025-02-27T06:08:41.546Z

Link: CVE-2025-27522

Vulnrichment

Updated: 2025-05-28T13:59:47.464Z

NVD

Status : Analyzed

Published: 2025-05-28T08:15:21.540

Modified: 2025-06-03T14:09:41.360

Link: CVE-2025-27522

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-27522", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2025-02-27T06:08:41.546Z", "datePublished": "2025-05-28T08:06:04.191Z", "dateUpdated": "2025-05-28T13:59:51.264Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Apache InLong", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "2.1.0", "status": "affected", "version": "1.13.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "yulate"}, {"lang": "en", "type": "finder", "value": "m4x"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Deserialization of Untrusted Data vulnerability in Apache InLong.</p><p>This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability is a secondary mining bypass for CVE-2024-26579. <span style=\"background-color: var(--wht);\">Users are advised to upgrade to Apache InLong's 2.2.0 or cherry-pick [1] to solve it.</span></p><p><span style=\"background-color: rgb(255, 255, 255);\">[1] <a target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/apache/inlong/pull/11732\">\n\n</a><a target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/apache/inlong/pull/11732\">https://github.com/apache/inlong/pull/11732</a></span></p><p></p>"}], "value": "Deserialization of Untrusted Data vulnerability in Apache InLong.\n\nThis issue affects Apache InLong: from 1.13.0 through 2.1.0.\u00a0This vulnerability is a secondary mining bypass for CVE-2024-26579.\u00a0Users are advised to upgrade to Apache InLong's 2.2.0 or cherry-pick [1] to solve it.\n\n[1] \n\n https://github.com/apache/inlong/pull/11732"}], "metrics": [{"other": {"content": {"text": "moderate"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2025-05-28T08:06:04.191Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/s4dnmq3gwcjocxf85qk190knlzd26jby"}, {"tags": ["patch"], "url": "https://github.com/apache/inlong/pull/11732"}], "source": {"discovery": "UNKNOWN"}, "title": "Apache InLong: JDBC Vulnerability during verification processing", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-05-28T13:59:28.927535Z", "id": "CVE-2025-27522", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-28T13:59:51.264Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-27522", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-28T13:59:28.927535Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-28T13:59:47.464Z"}}], "cna": {"title": "Apache InLong: JDBC Vulnerability during verification processing", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "yulate"}, {"lang": "en", "type": "finder", "value": "m4x"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache InLong", "versions": [{"status": "affected", "version": "1.13.0", "versionType": "semver", "lessThanOrEqual": "2.1.0"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread/s4dnmq3gwcjocxf85qk190knlzd26jby", "tags": ["vendor-advisory"]}, {"url": "https://github.com/apache/inlong/pull/11732", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Deserialization of Untrusted Data vulnerability in Apache InLong.\n\nThis issue affects Apache InLong: from 1.13.0 through 2.1.0.\u00a0This vulnerability is a secondary mining bypass for CVE-2024-26579.\u00a0Users are advised to upgrade to Apache InLong's 2.2.0 or cherry-pick [1] to solve it.\n\n[1] \n\n https://github.com/apache/inlong/pull/11732", "supportingMedia": [{"type": "text/html", "value": "<p>Deserialization of Untrusted Data vulnerability in Apache InLong.</p><p>This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability is a secondary mining bypass for CVE-2024-26579. <span style=\"background-color: var(--wht);\">Users are advised to upgrade to Apache InLong's 2.2.0 or cherry-pick [1] to solve it.</span></p><p><span style=\"background-color: rgb(255, 255, 255);\">[1] <a target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/apache/inlong/pull/11732\">\n\n</a><a target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/apache/inlong/pull/11732\">https://github.com/apache/inlong/pull/11732</a></span></p><p></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2025-05-28T08:06:04.191Z"}}}, "cveMetadata": {"cveId": "CVE-2025-27522", "state": "PUBLISHED", "dateUpdated": "2025-05-28T13:59:51.264Z", "dateReserved": "2025-02-27T06:08:41.546Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2025-05-28T08:06:04.191Z", "assignerShortName": "apache"}, "dataVersion": "5.1"}