Apache Linkis Password Exposure Vulnerability

A vulnerability in Apache Linkis versions 1.0.0 through 1.7.0 allows for the exposure of sensitive information, such as plaintext passwords and Hive Metastore keys, in log files. This occurs when the Base64 decoding function in 'org.apache.linkis.metadata.util.HiveUtils' fails to decode an invalid string. The error is logged with the original string, which can leak sensitive data if the log is accessible to users other than the administrators of 'hive-site.xml'.

Impact

The vulnerability leads to unauthorized information leakage of sensitive data, including passwords and Hive Metastore keys, into log files.

Remediation

Users are advised to upgrade to Apache Linkis version 1.8.0 or later, which addresses this vulnerability by sanitizing the logged error messages. The updated version can be obtained from the Apache Linkis official website.