https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 18:39:48 +0000 https://cve.radiocsirt.org/vuln/cve-2025-59355 <p><strong>Affected:</strong> Apache Software Foundation Apache Linkis</p> <p>A vulnerability.</p> <p>When org.apache.linkis.metadata.util.HiveUtils.decode() fails to perform Base64 decoding, it records the complete input parameter string in the log via logger.error(str + &#34;decode failed&#34;, e). If the input parameter contains sensitive information such as Hive Metastore keys, plaintext passwords will be left in the log files when decoding fails, resulting in information leakage.</p> <p>Affected Scope Component: Sensitive fields in hive-site.xml (e.g., javax.jdo.option.ConnectionPassword) or other fields encoded in Base64. Version: Apache Linkis 1.0.0 – 1.7.0</p> <p>Trigger Conditions The value of the configuration item is an invalid Base64 string. Log files are readable by users other than hive-site.xml administrators.</p> <p>Severity: Low The probability of Base64 decoding failure is low. The leakage is only triggered when logs at the Error level are exposed.</p> <p>Remediation Apache Linkis 1.8.0 and later versions have replaced the log with desensitized content. logger.error(&#34;URL decode failed: {}&#34;, e.getMessage()); // 不再输出 str</p> <p>Users are recommended to upgrade to version 1.8.0, which fixes the issue.</p> <p><strong>Affected:</strong> Apache Software Foundation Apache Linkis</p> <p>A vulnerability.</p> <p>When org.apache.linkis.metadata.util.HiveUtils.decode() fails to perform Base64 decoding, it records the complete input parameter string in the log via logger.error(str + &#34;decode failed&#34;, e). If the input parameter contains sensitive information such as Hive Metastore keys, plaintext passwords will be left in the log files when decoding fails, resulting in information leakage.</p> <p>Affected Scope Component: Sensitive fields in hive-site.xml (e.g., javax.jdo.option.ConnectionPassword) or other fields encoded in Base64. Version: Apache Linkis 1.0.0 – 1.7.0</p> <p>Trigger Conditions The value of the configuration item is an invalid Base64 string. Log files are readable by users other than hive-site.xml administrators.</p> <p>Severity: Low The probability of Base64 decoding failure is low. The leakage is only triggered when logs at the Error level are exposed.</p> <p>Remediation Apache Linkis 1.8.0 and later versions have replaced the log with desensitized content. logger.error(&#34;URL decode failed: {}&#34;, e.getMessage()); // 不再输出 str</p> <p>Users are recommended to upgrade to version 1.8.0, which fixes the issue.</p> https://cve.radiocsirt.org/vuln/cve-2025-59355