You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@flink.apache.org by "th555555 (via GitHub)" <gi...@apache.org> on 2025/05/10 09:54:02 UTC
[PR] Fix CVE-2022-25168 [flink]
th555555 opened a new pull request, #26545:
URL: https://github.com/apache/flink/pull/26545
This PR addresses a critical security vulnerability (Command Injection) in the extractTarFileUsingTar method of CompressionUtils.
Modified extractTarFileUsingTar to use a stream-based approach that passes file content through stdin instead of passing file paths to shell commands
This approach eliminates the possibility of command injection via malicious file paths
Maintains the same functionality while improving security
References
https://www.cve.org/CVERecord?id=CVE-2022-25168
https://github.com/apache/hadoop/commit/cae749b076f35f0be13a926ee8cfbb7ce4402746
This change is a trivial rework / code cleanup without any test coverage.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix CVE-2022-25168 [flink]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #26545:
URL: https://github.com/apache/flink/pull/26545#issuecomment-3204361277
This PR is being marked as stale since it has not had any activity in the last 90 days.
If you would like to keep this PR alive, please leave a comment asking for a review.
If the PR has merge conflicts, update it with the latest from the base branch.
If you are having difficulty finding a reviewer, please reach out to the
community, contact details can be found here: https://flink.apache.org/what-is-flink/community/
If this PR is no longer valid or desired, please feel free to close it.
If no activity occurs in the next 30 days, it will be automatically closed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix CVE-2022-25168 [flink]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] closed pull request #26545: Fix CVE-2022-25168
URL: https://github.com/apache/flink/pull/26545
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix CVE-2022-25168 [flink]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #26545:
URL: https://github.com/apache/flink/pull/26545#issuecomment-3310782546
This PR has been closed since it has not had any activity in 120 days.
If you feel like this was a mistake, or you would like to continue working on it,
please feel free to re-open the PR and ask for a review.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix CVE-2022-25168 [flink]
Posted by "davidradl (via GitHub)" <gi...@apache.org>.
davidradl commented on PR #26545:
URL: https://github.com/apache/flink/pull/26545#issuecomment-2871419320
the CI failure appears to be because of running out of space - I guess this is is either due to the fix or infrastructure (disk cleanup). If you think it is due to the disk needing cleating out - I suggest mailing the dev list.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix CVE-2022-25168 [flink]
Posted by "androidacy-user (via GitHub)" <gi...@apache.org>.
androidacy-user commented on PR #26545:
URL: https://github.com/apache/flink/pull/26545#issuecomment-2899482492
> the CI failure appears to be because of running out of space - I guess this is is either due to the fix or infrastructure (disk cleanup). If you think it is due to the disk needing cleating out - I suggest mailing the dev list.
It's a bot. Don't bother.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix CVE-2022-25168 [flink]
Posted by "davidradl (via GitHub)" <gi...@apache.org>.
davidradl commented on PR #26545:
URL: https://github.com/apache/flink/pull/26545#issuecomment-2871412596
@th555555 Looking at [our process ](https://flink.apache.org/how-to-contribute/contribute-code/ ), we need a Jira unless this is a hotfix. I suggest describing in more detail the approach you are taking in resolving this.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix CVE-2022-25168 [flink]
Posted by "flinkbot (via GitHub)" <gi...@apache.org>.
flinkbot commented on PR #26545:
URL: https://github.com/apache/flink/pull/26545#issuecomment-2868712086
<!--
Meta data
{
"version" : 1,
"metaDataEntries" : [ {
"hash" : "d10efa900198b5781ac4b288e64483e72374ffb2",
"status" : "UNKNOWN",
"url" : "TBD",
"triggerID" : "d10efa900198b5781ac4b288e64483e72374ffb2",
"triggerType" : "PUSH"
} ]
}-->
## CI report:
* d10efa900198b5781ac4b288e64483e72374ffb2 UNKNOWN
<details>
<summary>Bot commands</summary>
The @flinkbot bot supports the following commands:
- `@flinkbot run azure` re-run the last Azure build
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org