CVE-2021-36774

Mysql JDBC Connector Deserialize RCE

Description

Apache Kylin allows users to read data from other database systems using JDBC. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker to execute arbitrary code from a hacker-controlled malicious MySQL server within Kylin server processes. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions.

Remediation

Workaround:

Users of Kylin 2.x & Kylin 3.x should upgrade to 3.1.3 or apply patch https://github.com/apache/kylin/pull/1694.

6.5

CVSS

Severity: Medium

CVSS 3.1 •

CVSS 2.0 •

EPSS 0.83% Top 30%

Vendor Advisory apache.org

Affected: Apache Software Foundation Apache Kylin

References

Link	Tags
https://lists.apache.org/thread/lchpcvoolc6w8zc6vo1wstk8zbfqv2ow	vendor advisory mailing list
http://www.openwall.com/lists/oss-security/2022/01/06/5	third party advisory mailing list

Frequently Asked Questions

What is the severity of CVE-2021-36774?: CVE-2021-36774 has been scored as a medium severity vulnerability.
How to fix CVE-2021-36774?: As a workaround for remediating CVE-2021-36774: Users of Kylin 2.x & Kylin 3.x should upgrade to 3.1.3 or apply patch https://github.com/apache/kylin/pull/1694.
Is CVE-2021-36774 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2021-36774 is being actively exploited. According to its EPSS score, there is a ~1% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2021-36774?: CVE-2021-36774 affects Apache Software Foundation Apache Kylin.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.