GHSA-jxw2-jvxf-5vrp

Source

https://github.com/advisories/GHSA-jxw2-jvxf-5vrp

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/12/GHSA-jxw2-jvxf-5vrp/GHSA-jxw2-jvxf-5vrp.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-jxw2-jvxf-5vrp

Aliases

CVE-2024-49194

Published

2024-12-17T21:30:34Z

Modified

2025-07-02T14:56:55Z

Severity

7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N CVSS Calculator

Summary

Databricks JDBC Driver Command Injection vulnerability

Details

Databricks JDBC Driver 2.x before 2.6.40 could potentially allow remote code execution (RCE) by triggering a JNDI injection via a JDBC URL parameter. The vulnerability is rooted in the improper handling of the krbJAASFile parameter. An attacker could potentially exploit this vulnerability to achieve Remote Code Execution in the context of the driver by tricking a victim into using a crafted connection URL that uses the property krbJAASFile.

Database specific

{
    "cwe_ids":  [
        "CWE-77"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2024-12-18T19:49:41Z",
    "nvd_published_at":  "2024-12-17T20:15:22Z",
    "severity":  "HIGH"
}

References

Affected packages

Maven / com.databricks:databricks-jdbc

Package

Name: com.databricks:databricks-jdbc; View open source insights on deps.dev
Purl: pkg:maven/com.databricks/databricks-jdbc

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.0

Fixed

2.6.40

Affected versions

2.*

2.6.25-alpha-1

2.6.25-alpha-2

2.6.25-beta-1

2.6.25-beta-2

2.6.25-beta-3

2.6.25-beta-4

2.6.25

2.6.25-1

2.6.27-beta-1

2.6.27

2.6.29-beta-1

2.6.29

2.6.32

2.6.33

2.6.34

2.6.36

2.6.38

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/12/GHSA-jxw2-jvxf-5vrp/GHSA-jxw2-jvxf-5vrp.json"