VULNERABILITY INTELLIGENCE

CVE-2024-39928

CVSS score7.5 HIGH

EPSS probability0.58%

CISA KEVNot currently listed

Published2024-09-25

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

In Apache Linkis <= 1.5.0, a Random string security vulnerability in Spark EngineConn, random string generated by the Token when starting Py4j uses the Commons Lang's RandomStringUtils. Users are recommended to upgrade to version 1.6.0, which fixes this issue.

Weakness classification

CWE-326: Inadequate Encryption Strength

Primary references

security@apache.org — Mailing List, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory