From 722a8488b182371d7d38d2c560736a5d544e97bb Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Mon, 15 Jul 2024 17:42:28 +0000
Subject: [PATCH] Publish Advisories

GHSA-7qpc-4xx9-x5qw
GHSA-7qpc-4xx9-x5qw
---
 .../GHSA-7qpc-4xx9-x5qw.json                  | 69 +++++++++++++++++++
 .../GHSA-7qpc-4xx9-x5qw.json                  | 35 ----------
 2 files changed, 69 insertions(+), 35 deletions(-)
 create mode 100644 advisories/github-reviewed/2024/07/GHSA-7qpc-4xx9-x5qw/GHSA-7qpc-4xx9-x5qw.json
 delete mode 100644 advisories/unreviewed/2024/07/GHSA-7qpc-4xx9-x5qw/GHSA-7qpc-4xx9-x5qw.json

diff --git a/advisories/github-reviewed/2024/07/GHSA-7qpc-4xx9-x5qw/GHSA-7qpc-4xx9-x5qw.json b/advisories/github-reviewed/2024/07/GHSA-7qpc-4xx9-x5qw/GHSA-7qpc-4xx9-x5qw.json
new file mode 100644
index 00000000000..10dd11fcac2
--- /dev/null
+++ b/advisories/github-reviewed/2024/07/GHSA-7qpc-4xx9-x5qw/GHSA-7qpc-4xx9-x5qw.json
@@ -0,0 +1,69 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-7qpc-4xx9-x5qw",
+  "modified": "2024-07-15T17:40:59Z",
+  "published": "2024-07-15T09:36:23Z",
+  "aliases": [
+    "CVE-2023-49566"
+  ],
+  "summary": "Apache Linkis DataSource's JDBC Datasource Module with DB2 has JNDI Injection vulnerability",
+  "details": "In Apache Linkis <=1.5.0, due to the lack of effective filteringof parameters, an attacker configuring malicious `db2` parameters in the DataSource Manager Module will result in jndi injection. Therefore, the parameters in the DB2 URL should be blacklisted. \n\nThis attack requires the attacker to obtain an authorized account from Linkis before it can be carried out.\n\nVersions of Apache Linkis <=1.5.0 will be affected. We recommend users upgrade the version of Linkis to version 1.6.0.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.apache.linkis:linkis-datasource"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.6.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49566"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/apache/linkis"
+    },
+    {
+      "type": "WEB",
+      "url": "https://linkis.apache.org/download/release-notes-1.6.0"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.apache.org/thread/t68yy52lmv7pxgrxnq6rw7rwvk9tb1xj"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-502"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-07-15T17:40:59Z",
+    "nvd_published_at": "2024-07-15T08:15:02Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/07/GHSA-7qpc-4xx9-x5qw/GHSA-7qpc-4xx9-x5qw.json b/advisories/unreviewed/2024/07/GHSA-7qpc-4xx9-x5qw/GHSA-7qpc-4xx9-x5qw.json
deleted file mode 100644
index a79669510f8..00000000000
--- a/advisories/unreviewed/2024/07/GHSA-7qpc-4xx9-x5qw/GHSA-7qpc-4xx9-x5qw.json
+++ /dev/null
@@ -1,35 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-7qpc-4xx9-x5qw",
-  "modified": "2024-07-15T09:36:23Z",
-  "published": "2024-07-15T09:36:23Z",
-  "aliases": [
-    "CVE-2023-49566"
-  ],
-  "details": "\nIn Apache Linkis <=1.5.0, due to the lack of effective filtering\nof parameters, an attacker configuring malicious \n\ndb2\n\n parameters in the DataSource Manager Module will result in jndi injection. Therefore, the parameters in the DB2 URL should be blacklisted. \n\nThis attack requires the attacker to obtain an authorized account from Linkis before it can be carried out.\n\n Versions of Apache Linkis \n\n<=1.5.0\n\n will be affected.\nWe recommend users upgrade the version of Linkis to version 1.6.0.\n",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49566"
-    },
-    {
-      "type": "WEB",
-      "url": "https://lists.apache.org/thread/t68yy52lmv7pxgrxnq6rw7rwvk9tb1xj"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-      "CWE-502"
-    ],
-    "severity": null,
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2024-07-15T08:15:02Z"
-  }
-}
\ No newline at end of file