You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@linkis.apache.org by Heping Wang <pe...@apache.org> on 2023/04/10 06:14:37 UTC
CVE-2023-27602: Apache Linkis publicsercice module unrestricted upload of file
Severity: important
Description:
In Apache Linkis <=1.3.1, The PublicService module uploads files without restrictions on the path to the uploaded files, and file types.
We recommend users upgrade the version of Linkis to version 1.3.2.
For versions
<=1.3.1, we suggest turning on the file path check switch in linkis.properties
`wds.linkis.workspace.filesystem.owner.check=true`
`wds.linkis.workspace.filesystem.path.check=true`
Credit:
Laihan (reporter)
References:
https://linkis.apache.org
https://www.cve.org/CVERecord?id=CVE-2023-27602
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@linkis.apache.org
For additional commands, e-mail: dev-help@linkis.apache.org