apache/zeppelin · Security
Code injection in Apache Zeppelin Shell
- GHSA ID
- GHSA-8pfj-w89w-m24x
- CVE ID
- CVE-2024-31861
- Severity
- medium
- Published
- Updated
Description
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Zeppelin.
The attackers can use Shell interpreter as a code generation gateway, and execute the generated code as a normal way. This issue affects Apache Zeppelin: from 0.10.1 before 0.11.1.
Users are recommended to upgrade to version 0.11.1, which doesn't have Shell interpreter by default.
CWEs
- CWE-94 · Improper Control of Generation of Code ('Code Injection')