Description
In Alluxio before 2.7.3, the logserver does not validate the input stream. NOTE: this is not the same as the CVE-2021-44228 Log4j vulnerability.
Remediation
References
https://www.alluxio.io/download/releases/alluxio-2-7-3-release/
Related Vulnerabilities
CVE-2023-35153 Vulnerability in maven package org.xwiki.platform:xwiki-platform-appwithinminutes-ui
CVE-2018-20677 Vulnerability in maven package org.webjars.bowergithub.jasny:bootstrap
CVE-2019-17555 Vulnerability in maven package org.apache.olingo:odata-lib
CVE-2023-46604 Vulnerability in maven package org.apache.activemq:activemq-openwire-legacy
CVE-2023-30525 Vulnerability in maven package org.jenkins-ci.plugins:reportportal