{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T17:23:27.763Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "issue-tracking",
              "x_transferred"
            ],
            "url": "https://issues.apache.org/jira/browse/SUBMARINE-1361"
          },
          {
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/apache/submarine/pull/1037"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread/g99h773vd49n1wyghdq1llv2f83w1b3r"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Submarine",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "0.8.0",
              "status": "affected",
              "version": "0.7.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "lengjingqicai(\u68f1\u955c\u4e03\u5f69\u5f00\u6e90\u5b89\u5168\u7814\u7a76\u9662)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Apache Software Foundation Apache Submarine has an SQL injection vulnerability when a user logs in. This issue can result in unauthorized login.\u003cbr\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eNow we have fixed this issue and now user must have the correct login to access workbench.\u003c/span\u003e\u003cbr\u003e\u003cp\u003eThis issue affects Apache Submarine: from 0.7.0 before 0.8.0.\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eWe recommend that all submarine users with 0.7.0 upgrade to 0.8.0, which not only fixes the issue, supports the oidc authentication mode, but also removes the case of unauthenticated logins.\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u003cbr\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eIf using the version lower than 0.8.0 and not want to upgrade, you can try cherry-pick PR \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/apache/submarine/pull/1054\"\u003ehttps://github.com/apache/submarine/pull/1037\u003c/a\u003e and rebuild the submarine-server image to fix this.\u003c/span\u003e\u003cbr\u003e\u003c/span\u003e\u003c/p\u003e"
            }
          ],
          "value": "Apache Software Foundation Apache Submarine has an SQL injection vulnerability when a user logs in. This issue can result in unauthorized login.\nNow we have fixed this issue and now user must have the correct login to access workbench.\nThis issue affects Apache Submarine: from 0.7.0 before 0.8.0.\u00a0We recommend that all submarine users with 0.7.0 upgrade to 0.8.0, which not only fixes the issue, supports the oidc authentication mode, but also removes the case of unauthenticated logins.\nIf using the version lower than 0.8.0 and not want to upgrade, you can try cherry-pick PR  https://github.com/apache/submarine/pull/1037 https://github.com/apache/submarine/pull/1054  and rebuild the submarine-server image to fix this.\n\n"
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "critical"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-22T09:19:23.372Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://issues.apache.org/jira/browse/SUBMARINE-1361"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/apache/submarine/pull/1037"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/g99h773vd49n1wyghdq1llv2f83w1b3r"
        }
      ],
      "source": {
        "defect": [
          "SUBMARINE-1361"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Apache Submarine: SQL injection from unauthorized login",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2023-37924",
    "datePublished": "2023-11-22T09:19:23.372Z",
    "dateReserved": "2023-07-11T00:01:08.083Z",
    "dateUpdated": "2024-08-02T17:23:27.763Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:45:40.909Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "issue-tracking",
              "x_transferred"
            ],
            "url": "https://issues.apache.org/jira/browse/SUBMARINE-1371"
          },
          {
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/apache/submarine/pull/1054"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread/zf0wppzh239j4h131hm1dbswfnztxrr5"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Submarine",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "0.8.0",
              "status": "affected",
              "version": "0.7.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "GHSL team member @jorgectf (Jorge Rosillo)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Apache Software Foundation Apache Submarine has a bug when serializing against yaml. The bug is caused by snakeyaml \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://nvd.nist.gov/vuln/detail/CVE-2022-1471\"\u003ehttps://nvd.nist.gov/vuln/detail/CVE-2022-1471\u003c/a\u003e.\u003cbr\u003e\u003cbr\u003eApache Submarine uses JAXRS to define REST endpoints.  In order to\nhandle YAML requests (using application/yaml content-type), it defines\na YamlEntityProvider entity provider that will process all incoming\nYAML requests.  In order to unmarshal the request, the readFrom method\nis invoked, passing the entityStream containing the user-supplied data in `submarine-server/server-core/src/main/java/org/apache/submarine/server/utils/YamlUtils.java`.\u003cbr\u003e \u003cbr\u003eWe have now fixed this issue in the new version by replacing to `jackson-dataformat-yaml`.\u003cbr\u003eThis issue affects Apache Submarine: from 0.7.0 before 0.8.0.\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUsers are recommended to upgrade to version 0.8.0, which fixes this issue.\u003cbr\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eIf using the version smaller than 0.8.0  and not want to upgrade, you can try cherry-pick PR \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/apache/submarine/pull/1054\"\u003ehttps://github.com/apache/submarine/pull/1054\u003c/a\u003e and rebuild the submart-server image to fix this.\u003c/span\u003e\u003cbr\u003e\u003cbr\u003e\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "Apache Software Foundation Apache Submarine has a bug when serializing against yaml. The bug is caused by snakeyaml  https://nvd.nist.gov/vuln/detail/CVE-2022-1471 .\n\nApache Submarine uses JAXRS to define REST endpoints.  In order to\nhandle YAML requests (using application/yaml content-type), it defines\na YamlEntityProvider entity provider that will process all incoming\nYAML requests.  In order to unmarshal the request, the readFrom method\nis invoked, passing the entityStream containing the user-supplied data in `submarine-server/server-core/src/main/java/org/apache/submarine/server/utils/YamlUtils.java`.\n \nWe have now fixed this issue in the new version by replacing to `jackson-dataformat-yaml`.\nThis issue affects Apache Submarine: from 0.7.0 before 0.8.0.\u00a0Users are recommended to upgrade to version 0.8.0, which fixes this issue.\nIf using the version smaller than 0.8.0  and not want to upgrade, you can try cherry-pick PR  https://github.com/apache/submarine/pull/1054  and rebuild the submart-server image to fix this.\n\n"
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "critical"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-20T08:46:56.197Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://issues.apache.org/jira/browse/SUBMARINE-1371"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/apache/submarine/pull/1054"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/zf0wppzh239j4h131hm1dbswfnztxrr5"
        }
      ],
      "source": {
        "defect": [
          "SUBMARINE-1371"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Apache Submarine: Fix CVE-2022-1471 SnakeYaml unsafe deserialization",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2023-46302",
    "datePublished": "2023-11-20T08:46:56.197Z",
    "dateReserved": "2023-10-22T09:16:41.424Z",
    "dateUpdated": "2024-08-02T20:45:40.909Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}