Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.apache.shardingsphere:shardingsphere

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.8MavenPublished

    Apache ShardingSphere-Agent Deserialization of Untrusted Data vulnerability

    CVE-2023-28754 · GHSA-3cxh-xp3g-jxjm

    Affected
    • Maven org.apache.shardingsphere:shardingsphere <= 5.3.2
    Fixed in
    5.4.0· Vendor fix available
    Issue
    Deserialization of Untrusted Data vulnerability in Apache ShardingSphere-Agent, which allows attackers to execute arbitrary code by constructing a special YAML configuration file. The attacker needs to have permission to modify the ShardingSphere Agent YAML configuration file on the target machine, and the target machine can access the URL with the arbitrary code JAR. An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. When the ShardingSphere JVM process starts and uses the ShardingSphere-Agent, the arbitrary code specified by the attacker will be executed during the deserialization of the YAML configuration file by the Agent. This issue affects ShardingSphere-Agent: through 5.3.2. This vulnerability is fixed in Apache ShardingSphere 5.4.0.

    Recommended action: Upgrade to 5.4.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. Critical, CVSS 9.8MavenPublished

    Deserialization of Untrusted Data in Apache ShardingSphere

    CVE-2020-1947 · GHSA-v54f-xcmp-43cr

    Affected
    • Maven org.apache.shardingsphere:shardingsphere >= 4.0.0-RC3, <= 4.0.0
    Fixed in
    4.0.1· Vendor fix available
    Issue
    In Apache ShardingSphere(incubator) 4.0.0-RC3 and 4.0.0, the ShardingSphere&#39;s web console uses the SnakeYAML library for parsing YAML inputs to load datasource configuration. SnakeYAML allows to unmarshal data to a Java type By using the YAML tag. Unmarshalling untrusted data can lead to security flaws of RCE.

    Recommended action: Upgrade to 4.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →