You are viewing a plain text version of this content. The canonical link for it is here.
Posted to announce@apache.org by Leonard Xu <le...@apache.org> on 2025/10/09 13:05:53 UTC
CVE-2025-62228: Apache Flink CDC, Apache Flink CDC, Apache Flink CDC, Apache Flink CDC, Apache Flink CDC: SQL injection via maliciously crafted identifiers
Severity:
Affected versions:
- Apache Flink CDC (org.apache.flink:flink-connector-mysql-cdc) 3.0.0 through 3.4.0
- Apache Flink CDC (org.apache.flink:flink-connector-sqlserver-cdc) 3.0.0 through 3.4.0
- Apache Flink CDC (org.apache.flink:flink-connector-db2-cdc) 3.0.0 through 3.4.0
- Apache Flink CDC (org.apache.flink:flink-connector-oracle-cdc) 3.0.0 through 3.4.0
- Apache Flink CDC (org.apache.flink:flink-cdc-pipeline-connector-oceanbase) 3.3.0 through 3.4.0
Description:
Apache Flink CDC version 3.4.0 was vulnerable to a SQL injection via maliciously crafted identifiers eg. crafted database name or crafted table name. Even through only the logged-in database user can trigger the attack, we recommend users update Flink CDC version to 3.5.0 which address this issue.
Credit:
intSheep (reporter)
Mapta/BugBunny_ai (reporter)
References:
https://flink.apache.org/
https://www.cve.org/CVERecord?id=CVE-2025-62228
Re: CVE-2025-62228: Apache Flink CDC, Apache Flink CDC, Apache Flink CDC, Apache Flink CDC, Apache Flink CDC: SQL injection via maliciously crafted identifiers
Posted by saksham sapra <sa...@gmail.com>.
unsubscribe
\ ]
On Thu, Oct 9, 2025 at 6:36 PM Leonard Xu <le...@apache.org> wrote:
> Severity:
>
> Affected versions:
>
> - Apache Flink CDC (org.apache.flink:flink-connector-mysql-cdc) 3.0.0
> through 3.4.0
> - Apache Flink CDC (org.apache.flink:flink-connector-sqlserver-cdc) 3.0.0
> through 3.4.0
> - Apache Flink CDC (org.apache.flink:flink-connector-db2-cdc) 3.0.0
> through 3.4.0
> - Apache Flink CDC (org.apache.flink:flink-connector-oracle-cdc) 3.0.0
> through 3.4.0
> - Apache Flink CDC
> (org.apache.flink:flink-cdc-pipeline-connector-oceanbase) 3.3.0 through
> 3.4.0
>
> Description:
>
> Apache Flink CDC version 3.4.0 was vulnerable to a SQL injection via
> maliciously crafted identifiers eg. crafted database name or crafted table
> name. Even through only the logged-in database user can trigger the attack,
> we recommend users update Flink CDC version to 3.5.0 which address this
> issue.
>
> Credit:
>
> intSheep (reporter)
> Mapta/BugBunny_ai (reporter)
>
> References:
>
> https://flink.apache.org/
> https://www.cve.org/CVERecord?id=CVE-2025-62228
>
>
Unsubscribe
Posted by "Vengidasamy, Kanagaraj via user" <us...@flink.apache.org>.
Unsubscribe
Thanks
Kanagaraj Vengidasamy
7701 E Telecom PKWY
Temple Terrace, FL 33637
O 813.978.4372 <(813)%20978-4372> | M 813.455.9757 <(813)%20455-9757>
*https://verizon.webex.com/meet/kanagaraj.vengidasamy
<https://verizon.webex.com/meet/kanagaraj.vengidasamy>*
On Thu, Oct 9, 2025 at 9:07 AM Leonard Xu <le...@apache.org> wrote:
> Severity:
>
> Affected versions:
>
> - Apache Flink CDC (org.apache.flink:flink-connector-mysql-cdc) 3.0.0
> through 3.4.0
> - Apache Flink CDC (org.apache.flink:flink-connector-sqlserver-cdc) 3.0.0
> through 3.4.0
> - Apache Flink CDC (org.apache.flink:flink-connector-db2-cdc) 3.0.0
> through 3.4.0
> - Apache Flink CDC (org.apache.flink:flink-connector-oracle-cdc) 3.0.0
> through 3.4.0
> - Apache Flink CDC
> (org.apache.flink:flink-cdc-pipeline-connector-oceanbase) 3.3.0 through
> 3.4.0
>
> Description:
>
> Apache Flink CDC version 3.4.0 was vulnerable to a SQL injection via
> maliciously crafted identifiers eg. crafted database name or crafted table
> name. Even through only the logged-in database user can trigger the attack,
> we recommend users update Flink CDC version to 3.5.0 which address this
> issue.
>
> Credit:
>
> intSheep (reporter)
> Mapta/BugBunny_ai (reporter)
>
> References:
>
>
> https://urldefense.proofpoint.com/v2/url?u=https-3A__flink.apache.org_&d=DwIFaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=vykaCRzOoltktnhRTDFL-_xYCz_1_yDUiyVk9rjI72_Zyj_A4HNe3rj_MwyB9P22&m=jczBG9vbgsKPKbVjqRBWa6-tgaqov69I0rvDr7UH7Vc0SpuQly0jK_5cilAYO4C-&s=tCQtn7u_6bxWbkTZkjvDTdcpWAYY6LIYSEHlQL-Cw8A&e=
>
> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.cve.org_CVERecord-3Fid-3DCVE-2D2025-2D62228&d=DwIFaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=vykaCRzOoltktnhRTDFL-_xYCz_1_yDUiyVk9rjI72_Zyj_A4HNe3rj_MwyB9P22&m=jczBG9vbgsKPKbVjqRBWa6-tgaqov69I0rvDr7UH7Vc0SpuQly0jK_5cilAYO4C-&s=efh1PFk2ULrhzvjo6tuBlvJyfTTjEFjr1hY7wlCWRfA&e=
>
>