deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-55vq-xpjf-r2xc
Package: com.typesafe.akka:akka-stream-kafka_2.13 (MAVEN)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-312: Cleartext Storage of Sensitive Information, CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: < 4.0.2
Patched in: 4.0.2

Summary: Lightbend Alpakka Kafka logs credentials on debug level

Details:
Lightbend Alpakka Kafka before 4.0.2 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext login is configured). This occurs in akka.kafka.internal.KafkaConsumerActor.
GitHub Security Advisory: GHSA-55vq-xpjf-r2xc
Package: com.typesafe.akka:akka-stream-kafka_3 (MAVEN)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-312: Cleartext Storage of Sensitive Information, CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: < 4.0.2
Patched in: 4.0.2

Summary: Lightbend Alpakka Kafka logs credentials on debug level

Details:
Lightbend Alpakka Kafka before 4.0.2 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext login is configured). This occurs in akka.kafka.internal.KafkaConsumerActor.
GitHub Security Advisory: GHSA-3hw2-h67c-wq66
Package: com.typesafe.akka:akka-http-core_2.11 (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-674: Uncontrolled Recursion, CWE-787: Out-of-bounds Write
Vulnerable versions: >= 10.1.0, < 10.1.15
Patched in: 10.1.15

Summary: Uncontrolled Recursion in Akka HTTP

Details:
Akka HTTP 10.1.x and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments.
GitHub Security Advisory: GHSA-3hw2-h67c-wq66
Package: com.typesafe.akka:akka-http-core_2.12 (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-674: Uncontrolled Recursion, CWE-787: Out-of-bounds Write
Vulnerable versions: >= 10.2.0-M1, < 10.2.7
Patched in: 10.2.7

Summary: Uncontrolled Recursion in Akka HTTP

Details:
Akka HTTP 10.1.x and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments.
GitHub Security Advisory: GHSA-3hw2-h67c-wq66
Package: com.typesafe.akka:akka-http-core_2.12 (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-674: Uncontrolled Recursion, CWE-787: Out-of-bounds Write
Vulnerable versions: >= 10.1.0, < 10.1.15
Patched in: 10.1.15

Summary: Uncontrolled Recursion in Akka HTTP

Details:
Akka HTTP 10.1.x and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments.
GitHub Security Advisory: GHSA-3hw2-h67c-wq66
Package: com.typesafe.akka:akka-http-core_2.13 (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-674: Uncontrolled Recursion, CWE-787: Out-of-bounds Write
Vulnerable versions: >= 10.2.0-M1, < 10.2.7
Patched in: 10.2.7

Summary: Uncontrolled Recursion in Akka HTTP

Details:
Akka HTTP 10.1.x and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments.
GitHub Security Advisory: GHSA-3hw2-h67c-wq66
Package: com.typesafe.akka:akka-http-core_2.13 (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-674: Uncontrolled Recursion, CWE-787: Out-of-bounds Write
Vulnerable versions: >= 10.1.0, < 10.1.15
Patched in: 10.1.15

Summary: Uncontrolled Recursion in Akka HTTP

Details:
Akka HTTP 10.1.x and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments.
GitHub Security Advisory: GHSA-3hw2-h67c-wq66
Package: com.typesafe.akka:aakka-http-core_2.13.0-M3 (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-674: Uncontrolled Recursion, CWE-787: Out-of-bounds Write
Vulnerable versions: >= 10.1.0, < 10.1.15
Patched in: unpatched

Summary: Uncontrolled Recursion in Akka HTTP

Details:
Akka HTTP 10.1.x and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments.
GitHub Security Advisory: GHSA-3hw2-h67c-wq66
Package: com.typesafe.akka:akka-http-core_2.13.0-M5 (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-674: Uncontrolled Recursion, CWE-787: Out-of-bounds Write
Vulnerable versions: >= 10.1.0, < 10.1.15
Patched in: unpatched

Summary: Uncontrolled Recursion in Akka HTTP

Details:
Akka HTTP 10.1.x and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments.
GitHub Security Advisory: GHSA-3hw2-h67c-wq66
Package: com.typesafe.akka:akka-http-core_2.13.0-RC2 (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-674: Uncontrolled Recursion, CWE-787: Out-of-bounds Write
Vulnerable versions: >= 10.1.0, < 10.1.15
Patched in: unpatched

Summary: Uncontrolled Recursion in Akka HTTP

Details:
Akka HTTP 10.1.x and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments.
GitHub Security Advisory: GHSA-3hw2-h67c-wq66
Package: com.typesafe.akka:akka-http-core_2.13.0-RC3 (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-674: Uncontrolled Recursion, CWE-787: Out-of-bounds Write
Vulnerable versions: >= 10.1.0, < 10.1.15
Patched in: unpatched

Summary: Uncontrolled Recursion in Akka HTTP

Details:
Akka HTTP 10.1.x and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments.
GitHub Security Advisory: GHSA-2cpx-6pqp-wf35
Package: co.fs2:fs2-io_sjs1_3 (MAVEN)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-295: Improper Certificate Validation
Vulnerable versions: >= 3.1.0, < 3.2.11
Patched in: 3.2.11

Summary: fs2-io skips mTLS client verification

Details:
### Impact

When establishing a server-mode `TLSSocket` using `fs2-io` on Node.js, the parameter `requestCert = true` is ignored, peer certificate verification is skipped, and the connection proceeds.

The vulnerability is limited to:
1. `fs2-io` running on Node.js. The JVM TLS implementation is completely independent.
2. `TLSSocket`s in server-mode. Client-mode `TLSSocket`s are implemented via a different API.
3. mTLS as enabled via `requestCert = true` in `TLSParameters`. The default setting is `false` for server-mode `TLSSocket`s.

It was introduced with the initial Node.js implementation of fs2-io in v3.1.0.

### Patches

A patch is released in v3.2.11. The `requestCert = true` parameter is respected and the peer certificate is verified. If verification fails, a `SSLException` is raised.

### Workarounds

If using an unpatched version on Node.js, do not use a server-mode `TLSSocket` with `requestCert = true` to establish a mTLS connection.

### References
- https://github.com/nodejs/node/issues/43994
- https://www.cloudflare.com/learning/access-management/what-is-mutual-tls/

### For more information
If you have any questions or comments about this advisory:
* [Open an issue.](https://github.com/typelevel/fs2/issues/new/choose)
* Contact the [Typelevel Security Team](https://github.com/typelevel/.github/blob/main/SECURITY.md).
GitHub Security Advisory: GHSA-2cpx-6pqp-wf35
Package: co.fs2:fs2-io_sjs1_2.13 (MAVEN)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-295: Improper Certificate Validation
Vulnerable versions: >= 3.1.0, < 3.2.11
Patched in: 3.2.11

Summary: fs2-io skips mTLS client verification

Details:
### Impact

When establishing a server-mode `TLSSocket` using `fs2-io` on Node.js, the parameter `requestCert = true` is ignored, peer certificate verification is skipped, and the connection proceeds.

The vulnerability is limited to:
1. `fs2-io` running on Node.js. The JVM TLS implementation is completely independent.
2. `TLSSocket`s in server-mode. Client-mode `TLSSocket`s are implemented via a different API.
3. mTLS as enabled via `requestCert = true` in `TLSParameters`. The default setting is `false` for server-mode `TLSSocket`s.

It was introduced with the initial Node.js implementation of fs2-io in v3.1.0.

### Patches

A patch is released in v3.2.11. The `requestCert = true` parameter is respected and the peer certificate is verified. If verification fails, a `SSLException` is raised.

### Workarounds

If using an unpatched version on Node.js, do not use a server-mode `TLSSocket` with `requestCert = true` to establish a mTLS connection.

### References
- https://github.com/nodejs/node/issues/43994
- https://www.cloudflare.com/learning/access-management/what-is-mutual-tls/

### For more information
If you have any questions or comments about this advisory:
* [Open an issue.](https://github.com/typelevel/fs2/issues/new/choose)
* Contact the [Typelevel Security Team](https://github.com/typelevel/.github/blob/main/SECURITY.md).
GitHub Security Advisory: GHSA-2cpx-6pqp-wf35
Package: co.fs2:fs2-io_2.13 (MAVEN)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-295: Improper Certificate Validation
Vulnerable versions: >= 3.1.0, < 3.2.11
Patched in: 3.2.11

Summary: fs2-io skips mTLS client verification

Details:
### Impact

When establishing a server-mode `TLSSocket` using `fs2-io` on Node.js, the parameter `requestCert = true` is ignored, peer certificate verification is skipped, and the connection proceeds.

The vulnerability is limited to:
1. `fs2-io` running on Node.js. The JVM TLS implementation is completely independent.
2. `TLSSocket`s in server-mode. Client-mode `TLSSocket`s are implemented via a different API.
3. mTLS as enabled via `requestCert = true` in `TLSParameters`. The default setting is `false` for server-mode `TLSSocket`s.

It was introduced with the initial Node.js implementation of fs2-io in v3.1.0.

### Patches

A patch is released in v3.2.11. The `requestCert = true` parameter is respected and the peer certificate is verified. If verification fails, a `SSLException` is raised.

### Workarounds

If using an unpatched version on Node.js, do not use a server-mode `TLSSocket` with `requestCert = true` to establish a mTLS connection.

### References
- https://github.com/nodejs/node/issues/43994
- https://www.cloudflare.com/learning/access-management/what-is-mutual-tls/

### For more information
If you have any questions or comments about this advisory:
* [Open an issue.](https://github.com/typelevel/fs2/issues/new/choose)
* Contact the [Typelevel Security Team](https://github.com/typelevel/.github/blob/main/SECURITY.md).
GitHub Security Advisory: GHSA-2cpx-6pqp-wf35
Package: co.fs2:fs2-io_3 (MAVEN)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-295: Improper Certificate Validation
Vulnerable versions: >= 3.1.0, < 3.2.11
Patched in: 3.2.11

Summary: fs2-io skips mTLS client verification

Details:
### Impact

When establishing a server-mode `TLSSocket` using `fs2-io` on Node.js, the parameter `requestCert = true` is ignored, peer certificate verification is skipped, and the connection proceeds.

The vulnerability is limited to:
1. `fs2-io` running on Node.js. The JVM TLS implementation is completely independent.
2. `TLSSocket`s in server-mode. Client-mode `TLSSocket`s are implemented via a different API.
3. mTLS as enabled via `requestCert = true` in `TLSParameters`. The default setting is `false` for server-mode `TLSSocket`s.

It was introduced with the initial Node.js implementation of fs2-io in v3.1.0.

### Patches

A patch is released in v3.2.11. The `requestCert = true` parameter is respected and the peer certificate is verified. If verification fails, a `SSLException` is raised.

### Workarounds

If using an unpatched version on Node.js, do not use a server-mode `TLSSocket` with `requestCert = true` to establish a mTLS connection.

### References
- https://github.com/nodejs/node/issues/43994
- https://www.cloudflare.com/learning/access-management/what-is-mutual-tls/

### For more information
If you have any questions or comments about this advisory:
* [Open an issue.](https://github.com/typelevel/fs2/issues/new/choose)
* Contact the [Typelevel Security Team](https://github.com/typelevel/.github/blob/main/SECURITY.md).
GitHub Security Advisory: GHSA-2cpx-6pqp-wf35
Package: co.fs2:fs2-io_2.12 (MAVEN)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-295: Improper Certificate Validation
Vulnerable versions: >= 3.1.0, < 3.2.11
Patched in: 3.2.11

Summary: fs2-io skips mTLS client verification

Details:
### Impact

When establishing a server-mode `TLSSocket` using `fs2-io` on Node.js, the parameter `requestCert = true` is ignored, peer certificate verification is skipped, and the connection proceeds.

The vulnerability is limited to:
1. `fs2-io` running on Node.js. The JVM TLS implementation is completely independent.
2. `TLSSocket`s in server-mode. Client-mode `TLSSocket`s are implemented via a different API.
3. mTLS as enabled via `requestCert = true` in `TLSParameters`. The default setting is `false` for server-mode `TLSSocket`s.

It was introduced with the initial Node.js implementation of fs2-io in v3.1.0.

### Patches

A patch is released in v3.2.11. The `requestCert = true` parameter is respected and the peer certificate is verified. If verification fails, a `SSLException` is raised.

### Workarounds

If using an unpatched version on Node.js, do not use a server-mode `TLSSocket` with `requestCert = true` to establish a mTLS connection.

### References
- https://github.com/nodejs/node/issues/43994
- https://www.cloudflare.com/learning/access-management/what-is-mutual-tls/

### For more information
If you have any questions or comments about this advisory:
* [Open an issue.](https://github.com/typelevel/fs2/issues/new/choose)
* Contact the [Typelevel Security Team](https://github.com/typelevel/.github/blob/main/SECURITY.md).
GitHub Security Advisory: GHSA-5xqm-hc45-f2g2
Package: co.elastic.apm:elastic-apm-agent (MAVEN)
Severity: HIGH (CVSS 7.0)
CWE: CWE-269: Improper Privilege Management
Vulnerable versions: >= 1.18.0, < 1.27.1
Patched in: 1.27.1

Summary: APM Java Agent Local Privilege Escalation issue

Details:
A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious plugin to an application running the APM Java agent. By using this vulnerability, an attacker could execute code at a potentially higher level of permissions than their user typically has access to.
GitHub Security Advisory: GHSA-h7rh-xfpj-hpcm
Package: io.minio:minio (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-20: Improper Input Validation, CWE-91: XML Injection (aka Blind XPath Injection)
Vulnerable versions: < 8.6.0
Patched in: 8.6.0

Summary: MinIO Java Client XML Tag Value Substitution Vulnerability

Details:
#### Description
In minio-java versions prior to 8.6.0, XML tag values containing references to system properties or environment variables were automatically substituted with their actual values during processing. This unintended behavior could lead to the exposure of sensitive information, including credentials, file paths, or system configuration details, if such references were present in XML content from untrusted sources.

#### Affected Versions
- minio-java < 8.6.0

All applications utilizing affected versions of minio-java for parsing XML with potentially untrusted input are vulnerable.

#### Impact
This vulnerability poses a high risk of information disclosure. Attackers could craft malicious XML inputs to extract sensitive data from the system's properties or environment variables, potentially compromising security in applications relying on minio-java for object storage operations.

#### Patches
The issue is resolved in minio-java version 8.6.0 and later. In these versions, automatic substitution of XML tag values with system properties or environment variables has been disabled.

Users are strongly advised to upgrade to minio-java 8.6.0 or a newer release to mitigate the vulnerability.

#### Workarounds
No full workarounds exist without upgrading the library. As interim measures:

- Refrain from processing XML data from untrusted or external sources.
- Implement input sanitization or validation to detect and remove references to 
  system properties or environment variables in XML content.
GitHub Security Advisory: GHSA-f62v-xpxf-3v68
Package: org.apache.ant:ant (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: < 1.10.9
Patched in: 1.10.9

Summary: Code injection in Apache Ant

Details:
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.
GitHub Security Advisory: GHSA-gcfh-36x4-mgj6
Package: cn.hutool:hutool-extra (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
Vulnerable versions: < 5.8.40
Patched in: 5.8.40

Summary: Hutool allows remote code execution (RCE) via the QLExpressEngine class

Details:
An issue was discovered in chinabugotech hutool before 5.8.40 allowing attackers to execute arbitrary expressions that lead to arbitrary method invocation and potentially remote code execution (RCE) via the QLExpressEngine class.
GitHub Security Advisory: GHSA-hrqm-qpw9-w8rv
Package: com.liferay:com.liferay.portal.vulcan.impl (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-401: Missing Release of Memory after Effective Lifetime
Vulnerable versions: < 5.0.115
Patched in: 5.0.115

Summary: Liferay Portal and DXP vulnerable to a memory leak

Details:
A memory leak in the headless API for StructuredContents in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2024.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows an attacker to cause server unavailability (denial of service) via repeatedly calling the API endpoint.
GitHub Security Advisory: GHSA-rwqr-m72q-v6cm
Package: org.apache.xmlgraphics:batik-bridge (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: < 1.16
Patched in: 1.16

Summary: Untrusted code execution in Apache XML Graphics Batik

Details:
A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Apache XML Graphics prior to 1.16. Users are recommended to upgrade to version 1.16.
GitHub Security Advisory: GHSA-53jm-3hc9-fqqc
Package: org.apache.xmlgraphics:batik-bridge (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: < 1.15
Patched in: 1.15

Summary: Apache Batik vulnerable to Server-Side Request Forgery

Details:
Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik Bridge versions 1.14 and below.
GitHub Security Advisory: GHSA-53jm-3hc9-fqqc
Package: org.apache.xmlgraphics:batik (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: < 1.15
Patched in: 1.15

Summary: Apache Batik vulnerable to Server-Side Request Forgery

Details:
Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik Bridge versions 1.14 and below.
GitHub Security Advisory: GHSA-c5xv-qc8p-mh2v
Package: org.apache.xmlgraphics:batik-bridge (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 1.14, < 1.15
Patched in: 1.15

Summary: Apache Batik Server-Side Request Forgery 

Details:
Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol. This issue affects Apache XML Graphics Batik 1.14.
GitHub Security Advisory: GHSA-c5xv-qc8p-mh2v
Package: org.apache.xmlgraphics:batik (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 1.14, < 1.15
Patched in: 1.15

Summary: Apache Batik Server-Side Request Forgery 

Details:
Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol. This issue affects Apache XML Graphics Batik 1.14.
GitHub Security Advisory: GHSA-2hmj-97jw-28jh
Package: org.apache.zookeeper:zookeeper (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-280: Improper Handling of Insufficient Permissions or Privileges 
Vulnerable versions: >= 3.9.0, < 3.9.4
Patched in: 3.9.4

Summary: Apache ZooKeeper: Insufficient Permission Check in AdminServer Snapshot/Restore Commands

Details:
Improper permission checks in the AdminServer allow an authenticated client with insufficient privileges to invoke the `snapshot` and `restore` commands. The intended requirement is authentication and authorization on the root path (`/`) with **ALL** permission for these operations; however, affected versions permit invocation without that level of authorization. The primary risk is disclosure of cluster state via snapshots to a lesser-privileged client.

*   **Affected:** `org.apache.zookeeper:zookeeper` 3.9.0 through 3.9.3.
*   **Fixed:** 3.9.4 (ZOOKEEPER-4964 “check permissions individually during admin server auth”).
*   **Mitigations:**
    *   Disable both commands (`admin.snapshot.enabled`, `admin.restore.enabled`).
    *   Disable AdminServer (`admin.enableServer`).
    *   Ensure the root ACL is not open; note that ZooKeeper ACLs are not recursive.
    *   Upgrade to 3.9.4.
GitHub Security Advisory: GHSA-vx84-xvr8-w24c
Package: org.apache.iotdb:iotdb-core (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 1.3.3, < 2.0.5
Patched in: 2.0.5

Summary: Apache IoTDB: DoS Vulnerability

Details:
A vulnerability in Apache IoTDB.

This issue affects Apache IoTDB: from 1.3.3 through 1.3.4, from 2.0.1-beta through 2.0.4.

Users are recommended to upgrade to version 2.0.5, which fixes the issue.
GitHub Security Advisory: GHSA-776q-jw43-fhjx
Package: org.apache.iotdb:iotdb-confignode (MAVEN)
Severity: CRITICAL (CVSS 5.3)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: >= 1.0.0, < 2.0.5
Patched in: 2.0.5

Summary: Apache IoTDB: Deserialization of untrusted Data

Details:
### Summary

Apache IoTDB deserializes data from external inputs without sufficient validation, allowing attacker-controlled serialized objects to be processed. In environments where a compatible gadget chain is reachable, this can be abused to execute arbitrary code or alter server state; at minimum it enables high-impact integrity and confidentiality compromise on the IoTDB process.

### Affected

Apache IoTDB **from 1.0.0 before 2.0.5**.

### Remediation

Upgrade to **2.0.5**, which addresses the flaw. If immediate upgrade is not possible, restrict exposure of IoTDB endpoints to trusted networks and disable or sanitize any feature paths that accept serialized payloads. These mitigations are defense-in-depth only; upgrading to 2.0.5 is the definitive fix.