Apache Linkis creates a compute middleware layer to unify task and engine governance and orchestration while enabling cross-engine context sharing. It also provides standardized interfaces (REST, JDBC, WebSocket, etc.) to connect to multiple  engines like Spark, Presto, Flink, etc.

CVE-2022-3994

The JDBC EngineConn module has a flaw, which an attacker might use to deserialize and thereby get remote code execution.

A deserialization vulnerability exists in Apache Linkis =1.2.0 when combined with the MySQL Connector/J  when an advisory has write access to a database and configures a JDBC EC with a MySQL data source and malicious parameters. Consequently, it is necessary to blacklist the arguments in the jdbc url. Affected version includes Apache Linkis version prior to 1.3.0.

The vulnerability has been patched in the most recent version of Apache Linkis. Users are recommended to upgrade the JDBC EngineConn materials individually or install the unaffected version as soon as feasible,

WinRAR and ZIP File Exploits: This ZIP File Hack Could Let Malware Bypass Your Antivirus

5 Techniques Hackers Use to Jailbreak ChatGPT, Gemini, and Copilot AI systems

This Hacker Toolkit Can Breach Any Air-Gapped System – Here’s How It Works

Hacking Pagers to Explosions: Israel’s Covert Cyber-Physical Sabotage Operation Against Hezbollah!

Five Techniques for Bypassing Microsoft SmartScreen and Smart App Control (SAC) to Run Malware in Windows

How Millions of Phishing Emails were Sent from Trusted Domains: EchoSpoofing Explained

How to implement Principle of Least Privilege(Cloud Security) in AWS, Azure, and GCP cloud

The 11 Essential Falco Cloud Security Rules for Securing Containerized Applications at No Cost

Mike Stevens

Information security specialist, currently working as risk infrastructure specialist & investigator.
15 years of experience in risk and control process, security audit support, business continuity design and support, workgroup management and information security standards.