CVE-2023-46227: 
Java vulnerability analysis and mitigation

A Deserialization of Untrusted Data Vulnerability was discovered in Apache InLong, identified as CVE-2023-46227. The vulnerability affects Apache InLong versions from 1.4.0 through 1.8.0, where attackers can exploit a bypass using the '\t' character. The vulnerability was discovered by security researchers Zhiwei and S3gundo (Security Online).

The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data) with a CVSS v3.1 base score of 7.5 (HIGH), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. The vulnerability allows attackers to inject malicious code into a serialized data object and send it to an Apache InLong server, which upon deserialization, executes the malicious code (NVD, Security Online).

The vulnerability enables attackers to read arbitrary files on the target system. The attack can be executed remotely without requiring local system access, making it particularly dangerous. This could potentially lead to unauthorized access to sensitive information and system files (Security Online).

Users are advised to upgrade to Apache InLong version 1.9.0, which contains the necessary patches to address this vulnerability. Alternatively, users can apply a cherry-pick solution available at https://github.com/apache/inlong/pull/8814 (NVD, Security Online).