title: Apache Kylin unsafe class loading
description: Kylin can receive user input and load any class through Class.forName(...). This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions.
problem types: load any class
affected:
{
product: Apache Kylin
vendor: Apache Software Foundation
versions:
lessThanOrEqual: 2.6.6, status: affected, version: Apache Kylin 2, versionType: custom
lessThanOrEqual: 3.1.2, status: affected, version: Apache Kylin 3, versionType: custom
lessThanOrEqual: 4.0.0, status: affected, version: Apache Kylin 4, versionType: custom
}
metrics:
other: [
content: {'other': 'moderate'}
type: unknown
]
workarounds: Users of Kylin 2.x & Kylin 3.x should upgrade to 3.1.3 or apply patch https://github.com/apache/kylin/pull/1695.
Users of Kylin 4.x should upgrade to 4.0.1 or apply patch https://github.com/apache/kylin/pull/1763.