p PatchFirst

CVE-2024-24780

CVE-2024-24780 · Apache IoTDB: Remote Code Execution with untrusted URI of User-defined function

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Remote Code Execution with untrusted URI of UDF vulnerability in Apache IoTDB. The attacker who has privilege to create UDF can register malicious function from untrusted URI. This issue affects Apache IoTDB: from 1.0.0 before 1.3.4. Users are recommended to upgrade to version 1.3.4, which fixes the issue.

CVSS 9.8 · Critical · EPSS 1.4% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • apache iotdb

    Versions
    • ≥ 1.0.0, < 1.3.4: Affected (semver)

    Update to 1.3.4

  • org.apache.iotdb:iotdb-core Maven

    Versions
    • 1.3.0
    • 1.3.1
    • 1.3.2
    • 1.3.3
    Affected ranges
    • ECOSYSTEM: ≥ 1.0.0, < 1.3.4

    Update to 1.3.4

  • apache-iotdb PyPI

    Versions
    • 1.0.0
    • 1.0.1
    • 1.1.0
    • 1.1.2
    • 1.2.0
    • 1.2.1
    • 1.3.0
    • 1.3.2
    • 1.3.2.post0
    • 1.3.3
    Affected ranges
    • ECOSYSTEM: ≥ 1.0.0, < 1.3.4

    Update to 1.3.4

Original sources

Check your server →